Keycloak SAML XML parsing flaw lets attackers stall service
A login management server can be stalled by request floods.
Summary
Keycloak's SAML XML processing uses excessive CPU when parsing overly long dateTime and duration values. An unauthenticated remote attacker can send crafted SAML requests to deny service to all users.
What to do
Update to the Red Hat build of Keycloak 26.6.8 security update (RHSA-2026:95761).
Products and platforms
CVE IDs
Sources
Times
First published
First seen