Keycloak SAML 1.1 AuthorityBinding parsing loop crashes service

Summary

The SAML 1.1 assertion parser in Keycloak can enter an infinite loop on the AuthorityBinding element, consuming all memory and crashing the service. An unauthenticated remote attacker can trigger it, and Red Hat build of Keycloak 26.4 and 26.6 lines are affected.

What to do

Update the 26.4 line to 26.4.17 and the 26.6 line to 26.6.8.

Update to at least the version for your product:

• Red Hat build of Keycloak 26.4 26.4.17 or later
• Red Hat build of Keycloak 26.6 26.6.8 or later

Products and platforms

• Linux
• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.17
• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.8
• Red Hat Single Sign-On 7

CVE IDs

• CVE-2026-110931 (opens in a new tab)

Sources

• Advisory: access.redhat.com (opens in a new tab) · access.redhat.com (opens in a new tab) · access.redhat.com (opens in a new tab) · access.redhat.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-05 16:04 UTC

First seen 2026-11-09 17:00 UTC