BIT-keycloak-2026-7307: Keycloak: keycloak: denial of service via specially crafted saml input
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote, unauthenticated attacker that can reach a Keycloak SAML endpoint can submit the crafted XML input. No account or user interaction is required.
What is the operational impact of exploitation?
The malicious SAML XML can drive high CPU usage and starve worker threads, making the Keycloak server unavailable. The provided data identifies availability impact only; it does not indicate confidentiality or integrity impact.
How can I determine whether my deployment is exposed?
Determine whether your Keycloak deployment exposes a SAML endpoint that can be reached by untrusted remote clients. The supplied information does not identify affected versions or configuration-specific conditions.