CVE-2026-18212

HighCVSS 7.5/10Last modified Sep 16, 2026

Description

A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit this by sending repeated malformed SAML requests, leading to native memory exhaustion and a denial of service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 16, 2026
Last modified
Sep 16, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-182148.1Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flCVE-2026-182158.1Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw waCVE-2026-182166.5The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who CVE-2026-182174.7A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs wCVE-2026-182185.4A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens CVE-2026-18226.4The WP NG Weather plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ng-weather' shortcode in all versions CVE-2026-182207.8An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend (bfd/elf32-dlx.c) in GNU binutils. The dlx_rtype_to_howtCVE-2026-182219.8IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentCVE-2026-182235.0Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email CVE-2026-182287.1HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. UCVE-2026-18236.4The Consensus Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's consensus shortcode in all versions uCVE-2026-182308.1The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one o