CVE-2026-7307
Keycloak: keycloak: denial of service via specially crafted saml input
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Keycloak: keycloak: denial of service via specially crafted saml input
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.
- Record
CVE-2026-7307- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1286, CWE-1286
- Updated
- 2026-11-02
EUVDEUVD-2026-30883
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.
- Record
EUVD-2026-30883- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p5mv-gj8j-xqgf
Keycloak: Denial of Service via specially crafted SAML input
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.
- Record
GHSA-p5mv-gj8j-xqgf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1286
- Updated
- 2026-11-02
NVD
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.
- Record
CVE-2026-7307- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1286
- Updated
- 2026-11-02
OSV
Keycloak: keycloak: denial of service via specially crafted saml input
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.
- Record
CVE-2026-7307- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1286
- Updated
- 2026-11-06
OSVGHSA-p5mv-gj8j-xqgf
Keycloak: Denial of Service via specially crafted SAML input
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.
- Record
GHSA-p5mv-gj8j-xqgf- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1286
- Updated
- 2026-11-02
Show 4 moreShow less
OSVRHSA-2026:76128
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 7
- Record
RHSA-2026:76128- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2026:76129
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 8
- Record
RHSA-2026:76129- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2026:76130
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 9
- Record
RHSA-2026:76130- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSVBIT-keycloak-2026-7307 No score
Keycloak: keycloak: denial of service via specially crafted saml input
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.
- Record
BIT-keycloak-2026-7307- Updated
- 2026-11-02
Affected products
- red hat build of keycloak 26.2
- red hat build of keycloak 26.2.16
- red hat build of keycloak 26.4
- red hat build of keycloak 26.4.12
- red hat single sign-on 7.6 for rhel 7
- red hat single sign-on 7.6 for rhel 8
- red hat single sign-on 7.6 for rhel 9
- red hat single sign-on 7.6.13
- red hat rhel-8 based middleware containers
- redhat build of keycloak
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-saml-coreMaven |
before 26.6.2 | 26.6.2 |
keycloakBitnami |
26.4.0 up to 26.4.12 | 26.4.12 |
org.keycloak:keycloak-saml-coreMaven |
before 26.6.2, plus listed versions 1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta1 Show 45 moreShow less1.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final1.9.8.Final10.0.010.0.110.0.211.0.011.0.111.0.211.0.312.0.012.0.112.0.212.0.312.0.413.0.013.0.114.0.015.0.015.0.115.0.2 |
26.6.2 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 27 CVEs |
before 0:18.0.20-1.redhat_00001.1.el7sso | 0:18.0.20-1.redhat_00001.1.el7sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 27 CVEs |
before 0:18.0.20-1.redhat_00001.1.el7sso | 0:18.0.20-1.redhat_00001.1.el7sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 27 CVEs |
before 0:18.0.20-1.redhat_00001.1.el8sso | 0:18.0.20-1.redhat_00001.1.el8sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 27 CVEs |
before 0:18.0.20-1.redhat_00001.1.el8sso | 0:18.0.20-1.redhat_00001.1.el8sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 27 CVEs |
before 0:18.0.20-1.redhat_00001.1.el9sso | 0:18.0.20-1.redhat_00001.1.el9sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 27 CVEs |
before 0:18.0.20-1.redhat_00001.1.el9sso | 0:18.0.20-1.redhat_00001.1.el9sso |
History
| Recorded | Changed | Sources |
|---|---|---|
| references | OSV | |
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-7307 is a high vulnerability (CVSS 7.5) in Red Hat Build Of Keycloak 26.2, published May 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. Fixed in org.keycloak:keycloak-saml-core 26.6.2.
References
access.redhat.com/errata/RHSA-2026:19594
Show 158 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2476526
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7307.json
nvd.nist.gov/vuln/detail/CVE-2026-7307
github.com/keycloak/keycloak/pull/49119
catalog.redhat.com/software/containers
cve.org/CVERecord?id=CVE-2025-9784
issues.redhat.com/browse/UNDERTOW-2598
kb.cert.org/vuls/id/767506
Left out here: 157 versions. The JSON record has them.