7.5High
CVE-2026-7307Keycloak: keycloak: denial of service via specially crafted saml input
Description
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.
Weakness (CWE):
CWE-1286
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| build keycloak | 26.2 | — | |
| build keycloak | 26.4 | — | |
| redhat | build of keycloak | 26.4 – < 26.4.12 | |
| Red Hat | Red Hat build of Keycloak 26.2 | all versions | |
| Red Hat | Red Hat build of Keycloak 26.2.16 | — | |
| Red Hat | Red Hat build of Keycloak 26.4 | all versions | |
| Red Hat | Red Hat build of Keycloak 26.4.12 | — | |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | all versions | |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 8 | all versions | |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 9 | all versions | |
| Red Hat | Red Hat Single Sign-On 7.6.13 | — | |
| Red Hat | RHEL-8 based Middleware Containers | all versions | |
| red hat single sign on | 7.6 | — | |
| rhosemc | 1.0 | — | |
| — | keycloak | < 26.2.16, < 26.4.12, < 26.6.2 |
References and patches
- RHSA-2026:19594 vendor-advisoryVendor Advisory
- RHSA-2026:19595 vendor-advisoryVendor Advisory
- RHSA-2026:19596 vendor-advisoryVendor Advisory
- RHSA-2026:19597 vendor-advisoryVendor Advisory
- RHSA-2026:76128 vendor-advisory
- RHSA-2026:76129 vendor-advisory
- RHSA-2026:76130 vendor-advisory
- RHSA-2026:76132 vendor-advisory
- RHSA-2026:76134 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-7307 vdb-entryVendor Advisory
- RHBZ#2476526 issue-trackingVendor Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7307.json
CPE matches (NVD) (1)
cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*≥ 26.4 < 26.4.12