REDHAT-BUG-2547297: High severity Keycloak Keycloak vulnerability

Published Oct 7, 2026

Updated

A CPU-based Denial of Service vulnerability was found in Keycloak within the org.keycloak.saml component. The flaw exists in the way SAML XML dateTime and duration strings are parsed. When an XML document containing an excessively long string for these specific types is processed, the parser enters a resource-intensive state, consuming significant CPU cycles. An unauthenticated remote attacker can exploit this by sending crafted SAML XML payloads via HTTP POST to endpoints such as /realms/{realm}/protocol/saml, /realms/{realm}/broker/saml/endpoint, or /realms/{realm}/protocol/saml/resolve. Successful exploitation does not require valid client registration, credentials, or valid SAML signatures. The concrete impact is a sustained high CPU load on the Keycloak server, leading to service unresponsiveness and a total denial of service for authentication and authorization flows.

Affected Software

1 affected component

Keycloak Keycloak

Event History

Oct 7, 2026

Data Sourced

via Red Hat·07:37 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this attack?

Keycloak servers that process HTTP POST requests on the affected SAML endpoints are exposed, including /realms/{realm}/protocol/saml, /realms/{realm}/broker/saml/endpoint, and /realms/{realm}/protocol/saml/resolve.

Does an attacker need an account or a valid SAML assertion?

No. Exploitation does not require client registration, credentials, or a valid SAML signature.

What is required to trigger the resource exhaustion?

An attacker must send a crafted SAML XML payload containing an excessively long dateTime or duration string to an affected endpoint via HTTP POST.

What is the operational impact if exploitation succeeds?

The Keycloak server can sustain high CPU usage and become unresponsive, causing a total denial of service for authentication and authorization flows.

REDHAT-BUG-2547297: High severity Keycloak Keycloak vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this attack?

Does an attacker need an account or a valid SAML assertion?

What is required to trigger the resource exhaustion?

What is the operational impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this attack?

Does an attacker need an account or a valid SAML assertion?

What is required to trigger the resource exhaustion?

What is the operational impact if exploitation succeeds?