A flaw in the SAML XML processing of Keycloak allows an attacker to send XML documents containing very long dateTime or duration values. Because these strings are not validated before parsing, the XML parser consumes excessive CPU, creating a denial of service for all users. The vulnerability is a resource exhaustion weakness, classified as CWE‑400, and can be triggered without any authentication.

This issue affects Red Hat Build of Keycloak and Red Hat Single Sign‑On 7. No specific version numbers are listed, so any installation of these products that has not yet applied a vendor‑issued fix is considered vulnerable.

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation yet. Nonetheless, the attack can be carried out remotely by crafting a single SAML request, and it requires no privileged access, so the attack vector is Internet‑reachable and unauthenticated.