A memory leak flaw was found in Keycloaks SAML Redirect Binding. The implementation uses custom Deflater and Inflater instances to handle DEFLATE compression and decompression for SAML artifacts. These Java classes allocate native memory via zlib that is not managed by the standard Java heap. The code fails to call the end method on these instances, which is required to explicitly release the native resources.
An unauthenticated remote attacker can trigger this leak by sending specially crafted, malformed SAML Redirect requests to the Keycloak SAML endpoint. Because the native memory is not reclaimed by the Java garbage collector, repeated requests will cause the process resident set size (RSS) to grow until the operating system terminates the process due to memory exhaustion. Successful exploitation results in a complete denial of service for the Keycloak instance.