REDHAT-BUG-2476526: High severity Keycloak Keycloak vulnerability

Published May 12, 2026

Updated

A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.

Affected Software

1 affected component

Keycloak Keycloak

Event History

May 12, 2026

Data Sourced

via Red Hat·04:24 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2476526?

REDHAT-BUG-2476526 is classified as a high severity vulnerability due to its potential for causing Denial of Service (DoS).

How do I fix REDHAT-BUG-2476526?

To fix REDHAT-BUG-2476526, update Keycloak to the latest version that addresses this vulnerability.

What type of attack does REDHAT-BUG-2476526 allow?

REDHAT-BUG-2476526 allows a remote, unauthenticated attacker to conduct a Denial of Service (DoS) attack via specially crafted XML input.

Which software is affected by REDHAT-BUG-2476526?

The affected software for REDHAT-BUG-2476526 is Keycloak.

What is the consequence of exploiting REDHAT-BUG-2476526?

Exploiting REDHAT-BUG-2476526 can lead to high CPU usage and worker thread starvation, resulting in server downtime.