Description
A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution. The issue occurs when the server parses XML documents containing excessively long dateTime or duration values. Because these strings are not properly validated before processing, the XML parser consumes excessive CPU time. An unauthenticated remote attacker can exploit this by sending specially crafted SAML requests to the server, leading to high CPU utilization and a denial of service for all users.
Published: 2026-11-05
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. --- CME Mitigation Guidance (2026-11-06) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce length bounds on dateTime and duration values prior to XML parser processing in Keycloak SAML endpoints: upgrade to Keycloak 26.6.8 (or the fixed Rhbk/Keycloak Rhel/Keycloak Services builds), which validates and rejects excessively long dateTime and duration strings in SAML XML payloads before parser processing, closing all 2 injection vectors (crafted SAML XML payload with excessively long dateTime strings, crafted SAML XML payload with excessively long duration strings). Until patched, this is a concern on Keycloak deployments exposing SAML HTTP/S endpoints, so Restrict network access to exposed SAML endpoints where feasible and monitor for unusually large or malformed HTTP POST SAML requests. As a compensating measure, Constrain maximum CPU allocation for the Keycloak container or process group using cgroups v2 to prevent host starvation and Throttle unauthenticated HTTP POST requests to SAML endpoints to mitigate sustained single-source denial of service. These controls limit blast radius and contain exploitation, but they do not fix the underlying unvalidated XML dateTime and duration parsing defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 06 Nov 2026 17:15:00 +0000

Type Values Removed Values Added
References

Fri, 06 Nov 2026 10:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:build_keycloak: cpe:/a:redhat:build_keycloak:26.6::el9
References

Fri, 06 Nov 2026 08:30:00 +0000

Type Values Removed Values Added
First Time appeared Red Hat
Red Hat red Hat Build Of Keycloak 26.4
Redhat build Of Keycloak
Redhat single Sign-on
Vendors & Products Red Hat
Red Hat red Hat Build Of Keycloak 26.4
Redhat build Of Keycloak
Redhat single Sign-on

Fri, 06 Nov 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 05 Nov 2026 16:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution. The issue occurs when the server parses XML documents containing excessively long dateTime or duration values. Because these strings are not properly validated before processing, the XML parser consumes excessive CPU time. An unauthenticated remote attacker can exploit this by sending specially crafted SAML requests to the server, leading to high CPU utilization and a denial of service for all users.
Title Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsing
First Time appeared Redhat
Redhat build Keycloak
Redhat red Hat Single Sign On
Weaknesses CWE-400
CPEs cpe:/a:redhat:build_keycloak:
cpe:/a:redhat:red_hat_single_sign_on:7
Vendors & Products Redhat
Redhat build Keycloak
Redhat red Hat Single Sign On
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Red Hat Red Hat Build Of Keycloak 26.4
Redhat Build Keycloak Build Of Keycloak Red Hat Single Sign On Single Sign-on
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-11-06T19:55:13.708Z

Reserved: 2026-10-07T07:36:42.812Z

Link: CVE-2026-107123

cve-icon Vulnrichment

Updated: 2026-11-05T20:53:43.701Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-05T17:17:34.950

Modified: 2026-11-06T17:17:12.800

Link: CVE-2026-107123

cve-icon Redhat

Severity : Important

Publid Date: 2026-11-05T00:00:00Z

Links: CVE-2026-107123 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T08:15:17Z

Weaknesses