7.5 High

CVE-2026-82965 Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsing

Description

A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: None
Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
Red Hat Build of Keycloak	Versions not published
Red Hat Single Sign-On 7	Versions not published

References

access.redhat.com access.redhat.com
RHBZ#2526302 bugzilla.redhat.com

Timeline

Published November 5, 2026
Last modified November 5, 2026

The 266 CVEs of Red Hat Build of Keycloak →

CVE-2026-97847 Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority 7.1 High CVE-2026-97175 Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover 8.8 High CVE-2026-97174 Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens 6.8 Medium CVE-2026-96453 Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates 8.0 High

Track this CVE