Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state
cve-program · CVE-2026-18212
PublishedA flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit this by sending repeated malformed SAML requests, leading to native memory exhaustion and a denial of service.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-18212 · CVE overview and exploitation status
cve-program · CVE-2026-18212
Related changes
Linked by CVE identifierNo related changes are available here.