Description
A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users.
Published: 2026-11-05
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

A flaw in Keycloak’s SAML Artifact Resolution and ECP SOAP endpoints allows an unauthenticated attacker to send unbounded XML requests that consume excessive memory, causing the server to crash. The bug is a classic CWE-400 unbounded resource consumption, which results in a denial of service for all users of the impacted service.

Affected Systems

Red Hat Build of Keycloak and Red Hat Single Sign-on 7 are affected. No specific vulnerable versions are listed in the advisory; any installation of these products that has not been patched may be at risk.

Risk and Exploitability

The CVSS score is 7.5 and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Attackers can remotely exploit the flaw by sending large, syntactically valid SOAP messages to the SAML endpoints without authentication, forcing the application to use excessive memory until it runs out of resources.

Generated by OpenCVE AI on November 5, 2026 at 19:56 UTC.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

OpenCVE Recommended Actions

  • Update to the latest version of Red Hat Build of Keycloak that contains the fix, referenced in the Red Hat security advisory.
  • If an immediate update is impossible, configure the application or upstream proxy to limit the size of incoming SAML SOAP requests to prevent memory exhaustion.
  • Enable monitoring for sudden memory usage spikes or repeated failure logs and set alerts to detect possible exploitation attempts.
  • Consult the Red Hat advisory: no official workaround is available; continue to monitor for future fixes.

Generated by OpenCVE AI on November 5, 2026 at 19:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 17:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users.
Title Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsing
First Time appeared Redhat
Redhat build Keycloak
Redhat red Hat Single Sign On
Weaknesses CWE-400
CPEs cpe:/a:redhat:build_keycloak:
cpe:/a:redhat:red_hat_single_sign_on:7
Vendors & Products Redhat
Redhat build Keycloak
Redhat red Hat Single Sign On
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Redhat Build Keycloak Red Hat Single Sign On
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-11-05T18:51:14.642Z

Reserved: 2026-08-31T13:59:10.723Z

Link: CVE-2026-82965

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-05T17:18:21.983

Modified: 2026-11-05T19:17:27.320

Link: CVE-2026-82965

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T20:00:09Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption