CVE-2026-2575: Keycloak SAML Adapter Core Denial of Service Vulnerability
Summary
CVE-2026-2575: Keycloak: Denial of Service due to excessive SAMLRequest decompression. Affects org.keycloak:keycloak-saml-adapter-core versions < 26.5.4. Fixed in 26.5.4. How to fix ↓
Also tracked for
- keycloak · Bitnami
The same CVE-2026-2575 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that allows applications to secure their services with minimal effort. It provides features such as single sign-on (SSO), user federation, and identity brokering. The Keycloak SAML adapter core is a component that enables SAML-based authentication for applications. However, it is vulnerable to a Denial of Service (DoS) attack due to improper handling of compressed SAML requests, which can lead to service disruption.
Vulnerability Detail
A flaw was found in Keycloak's handling of SAML requests. An unauthenticated remote attacker can exploit this vulnerability by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, resulting in an OutOfMemoryError (OOM) and causing the application to terminate unexpectedly. This vulnerability can severely disrupt the availability of the Keycloak service, impacting all users relying on it for authentication.
How To Fix
Latest published version: 26.8.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
26.5.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement rate limiting on incoming SAML requests to mitigate the risk of a DoS attack. This can be done by configuring your web server or application gateway to limit the number of requests from a single IP address within a specified time frame.
Conclusion
In summary, CVE-2026-2575 is a vulnerability in Keycloak that can lead to a Denial of Service due to improper handling of compressed SAML requests. It is crucial to update to version 26.5.4 or later to mitigate this risk. Additionally, implementing rate limiting can serve as a temporary measure until the update is applied.
See every vulnerability recorded for org.keycloak:keycloak-saml-adapter-core →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted SAML requests.
The vulnerability can lead to a Denial of Service (DoS), causing the Keycloak service to become unavailable to users.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update immediately, consider implementing rate limiting as a temporary workaround to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-saml-adapter-core.
