{"action":"Upgrade org.keycloak:keycloak-services to 26.5.4 or later.","affected":[{"fixed":"26.5.4","introduced":"0"}],"component":"org.keycloak:keycloak-services","cve_ids":["CVE-2026-2575"],"ecosystem":"Maven","epss":0.00648,"exploited":false,"fixed_versions":["26.5.4"],"ghsa_id":"GHSA-xv6h-r36f-3gp5","id":"tcs_01M5N9JZ8RB6C3DG4WSGMJ46YQ","modified_at":"2026-10-06T18:45:07.149450142Z","published_at":"2026-03-18T06:31:20Z","references":["https://osv.dev/vulnerability/GHSA-xv6h-r36f-3gp5","https://nvd.nist.gov/vuln/detail/CVE-2026-2575","https://github.com/keycloak/keycloak/issues/46372","https://github.com/keycloak/keycloak/commit/4f90ef67f698dfb45df0d2f4981271a7c8b47f04","https://access.redhat.com/errata/RHSA-2026:3947","https://access.redhat.com/errata/RHSA-2026:3948","https://access.redhat.com/errata/RHSA-2026:76128","https://access.redhat.com/errata/RHSA-2026:76129","https://access.redhat.com/errata/RHSA-2026:76130","https://access.redhat.com/errata/RHSA-2026:76132","https://access.redhat.com/errata/RHSA-2026:76134","https://access.redhat.com/security/cve/CVE-2026-2575","https://bugzilla.redhat.com/show_bug.cgi?id=2440149","https://github.com/keycloak/keycloak"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-xv6h-r36f-3gp5#Maven/org.keycloak:keycloak-services","url":"https://osv.dev/vulnerability/GHSA-xv6h-r36f-3gp5"}],"summary":"Keycloak: Denial of Service due to excessive SAMLRequest decompression"}