CVEvulnerability

CVE-2026-18212

7.5 HIGH Published 2026-09-16 Modified 2026-09-16 Official page ↗
Status
Awaiting Analysis
Published
2026-09-16
Last modified
2026-09-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-401

Description

A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit this by sending repeated malformed SAML requests, leading to native memory exhaustion and a denial of service.

Related

Weakness · CWE (1)

  • CWE-401 Missing Release of Memory after Effective Lifetime weakness

References