A flaw in Red Hat’s Keycloak 26.4 build allows an unauthenticated remote attacker to trigger an application‑level denial of service by sending a highly compressed SAMLRequest via the SAML Redirect Binding. The server does not enforce size limits during DEFLATE decompression, which can cause an OutOfMemoryError that terminates the process and brings the service down. The vulnerability’s primary impact is availability loss; confidentiality and integrity remain unaffected.

Red Hat enterprise builds of Keycloak 26.4 and 26.4.10 running on Red Hat Enterprise Linux 9 are affected.

The CVSS base score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a remote, unauthenticated attacker who crafts an overly compressed SAMLRequest that reaches the Keycloak redirect endpoint; server‑side decompression fails, an OOM error occurs, and the service process exits, resulting in denial of service.