Aller au contenu
en Se connecter
5.3 Moyenne

CVE-2026-2575 A flaw was found in Keycloak

Description

A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.

Produits et versions touchés

Produit Versions touchées Corrigé en
Red Hat build of Keycloak 26.4 26.4 premières → < 26.4-12 26.4-12
Red Hat build of Keycloak 26.4.10 Versions non publiées
Red Hat Single Sign-On 7 Versions non publiées
Red Hat Single Sign-On 7.6.13 Versions non publiées
RHEL-8 based Middleware Containers 7.6 premières → < 7.6-85 7.6-85
Red Hat Single Sign-On 7.6 for RHEL 8 Versions non publiées
Red Hat Single Sign-On 7.6 for RHEL 9 Versions non publiées
Red Hat Single Sign-On 7.6 for RHEL 7 Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Red Hat build of Keycloak 26.4

Les 116 CVE de Red Hat build of Keycloak 26.4 →
CVE-2026-97848 Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization 6.5 Moyenne CVE-2026-97367 Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover 6.4 Moyenne CVE-2026-96547 Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles 6.5 Moyenne CVE-2026-97847 Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority 7.1 Élevée
Suivre cette CVE