Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-05-19T10:42:34 keycloak: Keycloak: Denial of Service via specially crafted SAML input 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-1286

A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.

A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.

This is a High severity denial of service vulnerability in Keycloak. An unauthenticated attacker with network access can send specially crafted XML input to the SAML endpoint, causing high CPU utilization and worker thread exhaustion, which renders the Keycloak server unavailable. This directly impacts the availability of Keycloak instances where the SAML protocol is enabled. Red Hat would like to thank Anchels for reporting this issue. To mitigate this vulnerability, restrict network access to the Keycloak SAML endpoint to trusted networks and clients. Implement firewall rules to limit inbound connections to the Keycloak service port (e.g., 8080) from untrusted sources. If the SAML protocol is not required for your deployment, consider disabling it to eliminate the attack surface. Applying these network restrictions or configuration changes may necessitate a restart or reload of the Keycloak service, which could temporarily affect its availability. Red Hat build of Keycloak 26.2 2026-05-20T00:00:00Z RHSA-2026:19595 rhbk/keycloak-operator-bundle:26.2.16-1 Red Hat build of Keycloak 26.2 2026-05-20T00:00:00Z RHSA-2026:19595 rhbk/keycloak-rhel9:26.2-21 Red Hat build of Keycloak 26.2 2026-05-20T00:00:00Z RHSA-2026:19595 rhbk/keycloak-rhel9-operator:26.2-21 Red Hat build of Keycloak 26.2.16 2026-05-20T00:00:00Z RHSA-2026:19594 rhbk/keycloak-rhel9 Red Hat build of Keycloak 26.4 2026-05-20T00:00:00Z RHSA-2026:19597 rhbk/keycloak-operator-bundle:26.4.12-1 Red Hat build of Keycloak 26.4 2026-05-20T00:00:00Z RHSA-2026:19597 rhbk/keycloak-rhel9:26.4-17 Red Hat build of Keycloak 26.4 2026-05-20T00:00:00Z RHSA-2026:19597 rhbk/keycloak-rhel9-operator:26.4-17 Red Hat build of Keycloak 26.4.12 2026-05-20T00:00:00Z RHSA-2026:19596 rhbk/keycloak-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-7307 https://nvd.nist.gov/vuln/detail/CVE-2026-7307