Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.keycloak/keycloak-saml-core@26.2.0
purl pkg:maven/org.keycloak/keycloak-saml-core@26.2.0
Next non-vulnerable version 26.5.4
Latest non-vulnerable version 26.5.4
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-xd7x-aevv-cfcp
Aliases:
CVE-2026-2575
GHSA-xv6h-r36f-3gp5
Keycloak: Denial of Service due to excessive SAMLRequest decompression A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.
26.5.4
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-29T23:27:58.308342+00:00 GitLab Importer Affected by VCID-xd7x-aevv-cfcp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.keycloak/keycloak-saml-core/CVE-2026-2575.yml 38.5.0
2026-04-19T18:07:47.320087+00:00 GitLab Importer Affected by VCID-xd7x-aevv-cfcp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.keycloak/keycloak-saml-core/CVE-2026-2575.yml 38.4.0