Description
A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.
Published: 2026-11-05
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Assess Impact
AI Analysis

Impact

The vulnerability resides in the SAML 1.1 assertion parser of Keycloak. An incomplete previous fix allows the parser to enter an infinite loop when processing the AuthorityBinding element of an authentication statement, causing the Java Virtual Machine to exhaust memory and crash. This results in the full Keycloak service becoming unavailable, effectively denying users access to any authentication or authorization functions. The weakness is an uncontrolled loop (CWE-835).

Affected Systems

Affected products include Red Hat Build of Keycloak and Red Hat Single Sign-On 7. No specific version range is supplied, so any deployed installation of these products may be impacted.

Risk and Exploitability

The CVSS score of 7.5 reflects a high severity due to the denial‑of‑service impact. EPSS is not available, so the exploitation probability is unclear, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated attacker who can forge a SAML 1.1 request containing a crafted AuthorityBinding element, which is then processed by the Keycloak server. Successful exploitation requires the ability to send such a request to the Keycloak service, leading to a crash of the JVM and service downtime.

Generated by OpenCVE AI on November 5, 2026 at 17:22 UTC.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

OpenCVE Recommended Actions

  • Apply any vendor patch or upgrade that resolves the infinite loop in the SAML 1.1 parser as soon as it is released.
  • If possible, disable or restrict the handling of SAML 1.1 AuthorityBinding elements to prevent the loop from being triggered.
  • Configure resource limits (e.g., cgroups or container memory caps) for the Keycloak JVM to contain memory exhaustion and reduce the impact of a crash.

Generated by OpenCVE AI on November 5, 2026 at 17:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 16:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.
Title Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loop
First Time appeared Redhat
Redhat build Keycloak
Redhat red Hat Single Sign On
Weaknesses CWE-835
CPEs cpe:/a:redhat:build_keycloak:
cpe:/a:redhat:red_hat_single_sign_on:7
Vendors & Products Redhat
Redhat build Keycloak
Redhat red Hat Single Sign On
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Redhat Build Keycloak Red Hat Single Sign On
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-11-05T16:04:53.045Z

Reserved: 2026-10-15T05:36:55.655Z

Link: CVE-2026-110931

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-05T17:17:37.280

Modified: 2026-11-05T17:17:37.423

Link: CVE-2026-110931

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T17:30:19Z

Weaknesses
  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')