CVE-2026-18212 Keycloak Denial of Service via SAML Redirect Binding

CVE-2026-18212 describes a memory management vulnerability within the SAML Redirect Binding implementation of Keycloak. The defect resides in the application's custom DEFLATE compression and decompression helpers, which fail to correctly release native zlib memory after processing SAML payloads. Because this logic is executed during the handling of incoming SAML Redirect Binding requests, it is accessible to unauthenticated remote users. By repeatedly sending specially crafted or malformed SAML requests that trigger this compression routine, an attacker can induce a steady accumulation of native memory usage, eventually leading to exhaustion of the Java Virtual Machine (JVM) native memory. This results in a persistent denial of service condition for the affected Keycloak instance.

Impact

Successful exploitation results in a complete denial of service for the Keycloak identity provider, preventing users from authenticating to any downstream applications or services integrated with the identity manager. This affects availability for organizations relying on Keycloak for Single Sign-On (SSO) and identity federation.

Recommendation

Prioritize monitoring for anomalous spikes in SAML authentication traffic or high rates of malformed HTTP requests targeting SAML endpoints. Ensure Keycloak instances are updated to the vendor-provided patch version (when available) that remediates the native zlib memory leak. Monitor system-level metrics (e.g., resident set size and native memory allocation) for the Keycloak process to detect memory exhaustion patterns indicative of exploitation.