Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.

CVE-2026-2575 identifies a vulnerability in Red Hat's build of Keycloak version 26.4, specifically related to the handling of highly compressed SAMLRequest messages sent via the SAML Redirect Binding. The vulnerability arises because the server fails to enforce size limits during the DEFLATE decompression process of incoming SAMLRequests. An attacker can craft a maliciously compressed SAMLRequest that decompresses to a very large size, causing excessive memory consumption. This leads to an OutOfMemoryError (OOM) in the Java runtime environment, which terminates the Keycloak process, resulting in a denial of service (DoS). The attack vector requires no authentication or user interaction, making it remotely exploitable by any unauthenticated attacker with network access to the Keycloak server. The vulnerability affects the availability of the service but does not compromise confidentiality or integrity of data. The CVSS v3.1 base score is 5.3, reflecting medium severity due to the lack of impact on confidentiality and integrity, but ease of exploitation and impact on availability. No patches or exploits are currently publicly documented, but the flaw is officially published and should be addressed promptly. This vulnerability is a form of data amplification attack, where small compressed input expands to a large decompressed size, overwhelming system resources. Keycloak is widely used for identity and access management in enterprise and cloud environments, making this vulnerability relevant for organizations relying on it for authentication and authorization services.

Detailed information about CVE-2026-2575: Improper Handling of Highly Compressed Data (Data Amplification) in Red Hat Red Hat build of Keycloak 26.4 affecting R

CVE-2026-2575: Improper Handling of Highly Compressed Data (Data Amplification) in Red Hat Red Hat build of Keycloak 26.4 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-2575: Improper Handling of Highly Compressed Data (Data Amplification) in Red Hat Red Hat build of Keycloak 26.4

Threats Tagged 'bit-keycloak-2026-2575'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'bit-keycloak-2026-2575'

Lead Pen Test Professional