CVE-2026-2575: 
Java vulnerability analysis and mitigation

CVE-2026-2575 is a Denial of Service (DoS) vulnerability in Keycloak caused by improper handling of highly compressed SAML data ("zip bomb" / data amplification). An unauthenticated remote attacker can send a highly compressed SAMLRequest via the SAML Redirect Binding; the server fails to enforce size limits during DEFLATE decompression, resulting in an OutOfMemoryError (OOM) and process termination. The vulnerability affects Red Hat build of Keycloak versions 26.4.x before 26.4.10. It was first disclosed on February 16, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-409 (Improper Handling of Highly Compressed Data / Data Amplification). When a SAML authentication request is submitted via the SAML Redirect Binding, Keycloak decompresses the DEFLATE-encoded SAMLRequest parameter without enforcing an upper bound on the decompressed output size. An attacker can craft a small, highly compressed payload that expands to an extremely large byte stream during decompression, exhausting the JVM heap and triggering an OutOfMemoryError that terminates the Keycloak process. No authentication or user interaction is required to trigger this condition (Red Hat CVE, Red Hat Bugzilla).

Successful exploitation results in a complete loss of availability for the Keycloak authentication service — the process crashes and becomes unavailable to all legitimate users until it is restarted. Because Keycloak serves as a central identity and SSO provider, its unavailability can cascade to all applications and services that depend on it for authentication, potentially causing a broad service outage. There is no impact on confidentiality or integrity; the attack is purely a DoS (Red Hat CVE, RHSA-2026:3947).

1. Reconnaissance: Identify internet-facing Keycloak instances (versions 26.4.x before 26.4.10) with SAML Redirect Binding enabled, using tools such as Shodan or Censys to locate exposed SAML SSO endpoints (e.g., /realms/<realm>/protocol/saml).
2. Craft compressed payload: Create a highly compressed DEFLATE payload (analogous to a "zip bomb") — a small input that decompresses to a very large byte sequence (e.g., many gigabytes of repeated data).
3. Encode the payload: Base64-encode the DEFLATE-compressed data and URL-encode it to form a valid SAMLRequest query parameter value.
4. Send the malicious request: Issue an HTTP GET or POST request to the Keycloak SAML Redirect Binding endpoint with the crafted SAMLRequest parameter: GET /realms/<realm>/protocol/saml?SAMLRequest=<encoded_payload>.
5. Trigger OOM: The Keycloak server decompresses the payload without size limits, exhausting JVM heap memory, causing an OutOfMemoryError and process termination, rendering the authentication service unavailable (Red Hat CVE, Red Hat Bugzilla).

• Logs: Java OutOfMemoryError stack traces in Keycloak server logs (e.g., keycloak.log or server.log) referencing SAML decompression or DEFLATE processing; sudden JVM heap exhaustion events logged by the application server.
• Network: Repeated HTTP requests to /realms/<realm>/protocol/saml with unusually large or anomalous SAMLRequest query parameter values from a single or small set of source IPs; requests with a small HTTP body/query string that trigger disproportionate server-side resource consumption.
• Process: Unexpected Keycloak process termination or restart events; monitoring alerts for JVM heap usage spiking to 100% followed by process crash.
• Application: Sudden unavailability of Keycloak SSO endpoints; downstream applications reporting authentication failures coinciding with Keycloak process restarts (Red Hat CVE).

Upgrade Red Hat build of Keycloak to version 26.4.10 or later, which enforces size limits during DEFLATE decompression of SAMLRequest data. Red Hat has released two security advisories addressing this issue: RHSA-2026:3947 (standalone packages) and RHSA-2026:3948 (OpenShift container images) (RHSA-2026:3947, RHSA-2026:3948). As a temporary workaround prior to patching, consider implementing network-level controls (e.g., WAF rules or reverse proxy configuration) to limit the size of incoming SAML requests or rate-limit SAML authentication requests from untrusted sources. Back up all configuration and data before applying updates.