Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-2575

20
FAUCET Score

CVE-2026-2575 describes a denial-of-service vulnerability in Keycloak, allowing an unauthenticated remote attacker to disrupt service availability. This flaw occurs when the server fails to enforce size limits during DEFLATE decompression of a highly compressed SAMLRequest, leading to an OutOfMemoryError and process termination. Rated Medium severity (CVSS 5.3), the attack has low complexity, requires no authentication or user interaction, and directly impacts the availability of the service. Currently, there is no known public exploit code, evidence of active exploitation, or significant community discussion regarding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
>= 26.4, < 26.4.10CPE matchmatch criteria
cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

5.3MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
Exploitability Score
3.9
Impact Score
1.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.50%
Probability of exploitation in next 30 days
EPSS Percentile
40.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0050 is in the 25th percentile among its peer group of 23,705 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (5)

mavenpatch availablevia ghsa
Product: org.keycloak:keycloak-saml-adapter-coreFixed in: 26.5.4
mavenpatch availablevia ghsa
Product: org.keycloak:keycloak-saml-coreFixed in: 26.5.4
mavenpatch availablevia ghsa
Product: org.keycloak:keycloak-servicesFixed in: 26.5.4
redhatvendor investigatingvia nvd_reference
View patch
redhatno patchvia redhat_api
Product: Red Hat Build of KeycloakFixed in: rhbk/keycloak-rhel9

Vendor Advisories (2)

mavenGHSA-xv6h-r36f-3gp5medium

Keycloak: Denial of Service due to excessive SAMLRequest decompression

Mar 18, 2026
redhatCVE-2026-2575Moderate

keycloak: Keycloak: Denial of Service due to excessive SAMLRequest decompression

Feb 16, 2026

References

access.redhat.com / errata/RHSA-2026:3947
Vendor Advisory
access.redhat.com / errata/RHSA-2026:3948
Vendor Advisory
access.redhat.com / security/cve/CVE-2026-2575
Vendor Advisory
bugzilla.redhat.com / show_bug.cgi
Issue TrackingVendor Advisory