This vulnerability in Red Hat Build of Keycloak arises from a memory leak in the SAML Redirect Binding's DEFLATE compression and decompression helpers, which do not release native zlib memory after use. An attacker without authentication can repeatedly send malformed SAML requests to exhaust native memory, causing a denial of service by crashing or hanging the Keycloak process. The root cause is the failure to explicitly release native zlib resources in the SAML DEFLATE helper classes. Red Hat has published an advisory confirming the issue and its impact but currently does not provide a patch or mitigation that meets their standards.

Successful exploitation results in a denial of service condition by exhausting native memory of the Keycloak process, causing it to crash, hang, or become unstable. There is no impact on confidentiality or integrity. The vulnerability can be triggered remotely without authentication.

Red Hat currently states that no mitigation is available or that existing options do not meet their criteria for ease of use, deployment, applicability, or stability. Users should monitor the Red Hat advisory for updates on fixes or mitigations. Until a fix is released, risk remains for denial of service via malformed SAML requests.