CVE-2026-2575

Katalog CVE

CVSS 5.3 · Medium EPSS 0,83%

Kerentanan Improper Handling of Highly Compressed Data (Data Amplification) pada redhat build of keycloak. Skor CVSS 3.1 5.3 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.

Rincian

Terbit di NVD

18 Maret 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

EPSS (30 hari)

0,83% peluang dieksploitasi; lebih tinggi dari 56,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:3947 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:3948 advisory vendor
• https://access.redhat.com/security/cve/CVE-2026-2575 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2440149 issue tracking · advisory vendor
• https://access.redhat.com/errata/RHSA-2026:76128
• https://access.redhat.com/errata/RHSA-2026:76129
• https://access.redhat.com/errata/RHSA-2026:76130
• https://access.redhat.com/errata/RHSA-2026:76132
• https://access.redhat.com/errata/RHSA-2026:76134