Keycloak SAML 1.1 parsing infinite loop allows unauthenticated denial of service

Summary

An infinite loop in the SAML 1.1 XML parsing logic of Keycloak lets an unauthenticated remote attacker drive CPU use to 100% and stop the service. A server restart is needed to recover.

What to do

Update Red Hat build of Keycloak 26.4 to 26.4.17 and the 26.6 line to 26.6.8 or later.

Update to at least the version for your product:

• Red Hat build of Keycloak 26.4 26.4.17 or later
• Red Hat build of Keycloak 26.6 26.6.8 or later

Products and platforms

• Linux
• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.17
• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.8
• Red Hat Single Sign-On 7

CVE IDs

• CVE-2026-107602 (opens in a new tab)

Sources

• Advisory: access.redhat.com (opens in a new tab) · access.redhat.com (opens in a new tab) · access.redhat.com (opens in a new tab) · access.redhat.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-05 16:04 UTC

First seen 2026-11-09 17:00 UTC