How severe is CVE-2026-2575?

CVE-2026-2575 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2026-2575 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (41st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-2575?

CVE-2026-2575 affects Redhat Build Of Keycloak. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-2575?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-2575 have an EU (EUVD) identifier?

Yes. CVE-2026-2575 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-12766.

When was CVE-2026-2575 published?

CVE-2026-2575 was published on 2026-03-18 and last updated on 2026-06-17.

CVE-2026-2575

CVE-2026-2575 is a medium-severity vulnerability in Redhat Build Of Keycloak with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-409.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 1% (41st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-12766
Weakness: CWE-409
Affected product: Redhat Build Of Keycloak
Published: 2026-03-18
Last modified: 2026-06-17

Description

A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.

Frequently asked questions

What is CVE-2026-2575?: A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.
How severe is CVE-2026-2575?: CVE-2026-2575 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2026-2575 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (41st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-2575?: CVE-2026-2575 affects Redhat Build Of Keycloak. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-2575?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-2575 have an EU (EUVD) identifier?: Yes. CVE-2026-2575 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-12766.
When was CVE-2026-2575 published?: CVE-2026-2575 was published on 2026-03-18 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*

More vulnerabilities in Redhat Build Of Keycloak

CVE-2026-15572 — High (CVSS 8.8): A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol…
CVE-2026-3047 — High (CVSS 8.8): A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is…
CVE-2026-16102 — High (CVSS 8.1): A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management…
CVE-2026-15573 — High (CVSS 8.1): A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security…
CVE-2026-1609 — High (CVSS 8.1): A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user…
CVE-2026-11800 — High (CVSS 8.1): A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an…

All CVEs affecting Redhat Build Of Keycloak →

Other CWE-409 vulnerabilities

CVE-2026-62963 — High (CVSS 8.7): Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket…
CVE-2026-55195 — High (CVSS 8.7): py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and…
CVE-2026-53430 — High (CVSS 8.7): Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc…
CVE-2026-44697 — High (CVSS 8.6): Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, a remote, unauthenticated…
CVE-2026-44981 — High (CVSS 8.2): CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used…
CVE-2026-43970 — High (CVSS 8.2): Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib allows…

Browse all CWE-409 vulnerabilities →