Bug 2508307 (CVE-2026-18212)

Summary: CVE-2026-18212 keycloak-services: keycloak-services: SAML Redirect DEFLATE helpers leak native zlib state
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dlofthou, drichtar, istudens, ivassile, iweiss, mosmerov, mposolda, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rmartinc, rstancel, security-response-team, ssilvert, sthorger, thjenkin, vdosoudi, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit this by sending repeated malformed SAML requests, leading to native memory exhaustion and a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-10-26   

Description OSIDB Bzimport 2026-07-29 08:31:48 UTC 
A memory leak flaw was found in Keycloaks SAML Redirect Binding. The implementation uses custom Deflater and Inflater instances to handle DEFLATE compression and decompression for SAML artifacts. These Java classes allocate native memory via zlib that is not managed by the standard Java heap. The code fails to call the end method on these instances, which is required to explicitly release the native resources.
An unauthenticated remote attacker can trigger this leak by sending specially crafted, malformed SAML Redirect requests to the Keycloak SAML endpoint. Because the native memory is not reclaimed by the Java garbage collector, repeated requests will cause the process resident set size (RSS) to grow until the operating system terminates the process due to memory exhaustion. Successful exploitation results in a complete denial of service for the Keycloak instance.