CVE-2026-18212

CVE-2026-18212 is a memory leak (CWE-401) in the SAML Redirect Binding implementation of Keycloak, Red Hat's open-source identity and access management solution: the custom DEFLATE compression and decompression helpers allocate native zlib memory but never release it. An unauthenticated remote attacker can trigger the leak by sending repeated malformed SAML requests that exercise the Redirect Binding DEFLATE path. Because the leaked memory is native (outside the JVM heap), accumulation eventually exhausts process memory and causes a denial of service, despite the attacker gaining no code execution or data access. Any Keycloak deployment (including Red Hat Single Sign-On derivatives) that accepts SAML Redirect Binding requests is affected. Exploitation has not been observed in the wild, no proof-of-concept is public, and the flaw is not in the CISA KEV catalog.

What to do: Upgrade Keycloak (and Red Hat Single Sign-On derivatives) to the patched release named in the Red Hat security advisory for CVE-2026-18212, as no fixed version is specified in the data available here. Until patched, limit internet exposure of Keycloak/SAML endpoints (VPN, allowlisting, or WAF rate-limiting on SAML request paths) and monitor native process memory for abnormal growth, restarting instances that show sustained leaks. Confirm whether your realms use SAML Redirect Binding, since deployments using only other bindings have reduced exposure.