CVE-2026-110931: Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loop
A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.
Other sources
A flaw was found in the SAML 1.1 assertion parser within the keycloak-saml-core library. The vulnerability is an infinite loop triggered when an AuthenticationStatement contains an AuthorityBinding child element. The parser fails to advance past this element, repeatedly processing it and growing an internal list until the Java heap is exhausted. This leads to a java.lang.OutOfMemoryError and immediate JVM termination. This issue represents an incomplete fix for CVE-2026-7307. A remote, unauthenticated attacker can exploit this by sending a single specially crafted SAML request to the realm SAML endpoint or the SAML identity provider broker endpoint. Successful exploitation allows an attacker to stop the Keycloak node completely, preventing all logins, token issuance, and administrative functions until the process is manually restarted.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Keycloak deployments that expose a realm SAML endpoint or a SAML identity provider broker endpoint are exposed. An attacker can send a crafted SAML request remotely without authentication.
What does an attacker need to do to cause an outage?
The attacker needs to send a single specially crafted SAML 1.1 request containing an AuthenticationStatement with an AuthorityBinding child element. The parsing loop can exhaust the Java heap, raise java.lang.OutOfMemoryError, and terminate the Keycloak JVM.
What is the operational impact if exploitation succeeds?
The affected Keycloak node stops completely, making the service unavailable and preventing logins. The provided impact information indicates availability impact only; confidentiality and integrity impacts are not listed.
Is this related to an earlier Keycloak vulnerability?
Yes. The issue is described as an incomplete fix for CVE-2026-7307.