Keycloak Denial-of-Service Vulnerability via Excessive SAMLRequest Decompression

A denial-of-service vulnerability has been identified in Keycloak. An unauthenticated remote attacker can exploit this issue by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server does not properly enforce size limits during the DEFLATE decompression process, which leads to an OutOfMemoryError and causes the application to terminate. This vulnerability disrupts the availability of the service.

Impact

Exploitation of this vulnerability causes the Keycloak server process to run out of memory and terminate, disrupting authentication services and user management capabilities.

Remediation

Users can upgrade to the Red Hat build of Keycloak 26.4.10, which addresses this vulnerability. Instructions for downloading this version are available on the Red Hat Customer Portal.