CVE-2026-18212: Keycloak SAML Memory Exhaustion DOS Vulnerability

CVE-2026-18212 Overview

CVE-2026-18212 is a memory leak vulnerability in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The flaw resides in custom DEFLATE compression and decompression helpers that fail to release native zlib memory after use. An unauthenticated attacker can send repeated malformed Security Assertion Markup Language (SAML) requests to exhaust native memory on the target server. Sustained exploitation results in a denial of service against the Keycloak identity provider, disrupting authentication for all federated applications. Red Hat has published multiple advisories addressing the issue across affected product streams. The vulnerability is tracked under [CWE-401] (Missing Release of Memory after Effective Lifetime).

Critical Impact
Unauthenticated remote attackers can trigger native memory exhaustion in Keycloak, causing service-wide denial of authentication for downstream applications.

Affected Products

Red Hat build of Keycloak (see Red Hat CVE-2026-18212 Details)
Keycloak SAML Redirect Binding implementation
Products covered by advisories RHSA-2026:68276, RHSA-2026:68277, RHSA-2026:68278, and RHSA-2026:68280

Discovery Timeline

2026-09-16 - CVE-2026-18212 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-18212

Vulnerability Analysis

The vulnerability originates in Keycloak's handling of SAML messages transmitted via the HTTP Redirect Binding. This binding requires SAML payloads to be DEFLATE-compressed before being base64-encoded and appended to the authentication URL. Keycloak implements custom helpers to compress outbound assertions and decompress inbound requests using native zlib primitives. These helpers do not consistently release the underlying native memory allocations once processing completes or fails. Each malformed request that reaches the decompression path leaks a small amount of off-heap memory. Because the allocation lives outside the Java Virtual Machine (JVM) heap, standard garbage collection does not reclaim it and JVM heap limits do not bound its growth. Repeated invocations drive the process toward native memory exhaustion and eventual failure to allocate resources for legitimate authentication traffic.

Root Cause

The root cause is a missing release of native resources after use, categorized as [CWE-401]. The DEFLATE helper wrappers around zlib fail to call the required end-of-stream cleanup on all code paths, particularly error and exception paths triggered by malformed input. Native handles remain allocated for the lifetime of the process.

Attack Vector

An unauthenticated remote attacker sends a stream of malformed SAML AuthnRequest or LogoutRequest messages to a Keycloak SAML endpoint using the HTTP Redirect Binding. Each request forces the server into the leaky decompression path. Sustained request volume progressively exhausts native memory until the Keycloak process becomes unresponsive or terminates. No authentication, user interaction, or specialized network position is required.

No verified public proof-of-concept code is available. Refer to the Red Hat Bug #2508307 Report for technical context.

Detection Methods for CVE-2026-18212

Indicators of Compromise

Sustained growth in Keycloak process resident set size (RSS) that is not reflected in JVM heap usage metrics.
Repeated SAML Redirect Binding requests from a single source containing malformed or truncated SAMLRequest query parameters.
Keycloak logs recording decompression errors or zlib exceptions correlated with a spike in request volume.
Out-of-memory conditions or OutOfMemoryError: unable to create native thread messages preceding service degradation.

Detection Strategies

Monitor Keycloak native memory usage separately from JVM heap metrics and alert on non-transient upward trends.
Inspect access logs for high-frequency requests to /realms/*/protocol/saml endpoints originating from single sources or small IP ranges.
Correlate decompression parsing errors in Keycloak server logs with increases in memory consumption over time.

Monitoring Recommendations

Instrument the Keycloak container or JVM with native memory tracking to observe zlib allocation growth.
Deploy web application firewall rules that flag oversized or malformed SAMLRequest parameters.
Establish baselines for SAML endpoint request rates per source and alert on statistically significant deviations.

How to Mitigate CVE-2026-18212

Immediate Actions Required

Apply the patches referenced in RHSA-2026:68276, RHSA-2026:68277, RHSA-2026:68278, and RHSA-2026:68280 to affected Keycloak deployments.
Restart Keycloak instances after patching to reclaim any leaked native memory from prior exposure.
Rate-limit unauthenticated requests to SAML Redirect Binding endpoints at the reverse proxy or load balancer.

Patch Information

Red Hat has issued fixes for affected Keycloak builds. Consult the Red Hat CVE-2026-18212 Details page for the authoritative list of fixed package versions and errata mappings. Upstream Keycloak users should track the corresponding project release notes and update to the patched release stream.

Workarounds

Restrict access to Keycloak SAML endpoints to trusted networks or identity federation partners where feasible.
Enforce request-rate and payload-size limits at an upstream reverse proxy to constrain the volume of malformed SAML requests reaching Keycloak.
Schedule periodic restarts of Keycloak instances as a temporary measure to reclaim leaked native memory until patches are deployed.

bash

# Example NGINX rate-limit configuration for Keycloak SAML endpoints
# Consult vendor documentation before applying in production
limit_req_zone $binary_remote_addr zone=saml_zone:10m rate=10r/s;

location ~ ^/realms/.*/protocol/saml {
    limit_req zone=saml_zone burst=20 nodelay;
    client_max_body_size 64k;
    proxy_pass http://keycloak_backend;
}