CVE-2026-107602: Keycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loop
A flaw was found in Keycloak's SAML 1.1 XML parsing logic within the keycloak-saml-core component. When parsing the ds:KeyInfo element in SAML 1.1 assertions, the StAX-based parser loops over child elements but only contains logic to handle specific expected tags such as ds:EncryptedKey, ds:X509Data, and ds:KeyValue. The parser lacks a fallback branch to consume or reject other valid child elements like ds:KeyName. Consequently, the parser repeatedly peeks at the unhandled element without advancing, causing the processing thread to enter an infinite loop spinning at 100% CPU. An unauthenticated remote attacker can exploit this by sending crafted SAML requests to Keycloak's SAML endpoints (e.g., /realms/{realm}/protocol/saml). By sending multiple concurrent requests, an attacker can exhaust the worker thread pool, resulting in a permanent denial of service until the server is manually restarted.
Other sources
A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token's key information section, causing the processing thread to enter an infinite loop. An unauthenticated remote attacker could exploit this by sending specially crafted requests, leading to 100% CPU usage and a total denial of service that requires a server restart to resolve.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it by sending crafted SAML requests to Keycloak SAML endpoints, such as /realms/{realm}/protocol/saml. No user interaction or existing account is required.
What is the operational impact of exploitation?
Each crafted request can cause a processing thread to spin at 100% CPU. Multiple concurrent requests can exhaust the worker-thread pool and cause a persistent denial of service until the server is manually restarted.
What request content triggers the vulnerable parser behavior?
The condition occurs while parsing a SAML 1.1 assertion containing a ds:KeyInfo element with a child element the parser does not handle, such as ds:KeyName. The parser recognizes expected tags including ds:EncryptedKey, ds:X509Data, and ds:KeyValue, but does not consume or reject other valid child elements.