CVE-2026-7307— Keycloak: keycloak: denial of service via specially crafted saml input
Possible ATT&CK Techniques 1AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.2 | 26.2.16-1< * | unaffected |
26.2-21< * | unaffected | ||
26.2-21< * | unaffected | ||
| Red Hat | Red Hat build of Keycloak 26.2.16 | any | unaffected |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4.12-1< * | unaffected |
26.4-17< * | unaffected | ||
26.4-17< * | unaffected | ||
| Red Hat | Red Hat build of Keycloak 26.4.12 | any | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-7307
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Keycloak: keycloak: denial of service via specially crafted saml input
Source: NVD (National Vulnerability Database)
Vulnerability Description
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
CWE-1286
Source: NVD (National Vulnerability Database)
Vulnerability Title
Keycloak 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Keycloak是Keycloak开源的一种开源身份和访问管理解决方案。 Keycloak存在安全漏洞，该漏洞源于远程未经身份验证的攻击者可发送特制XML输入到SAML端点，可能导致高CPU使用率和工作线程饥饿，造成拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.2 | 26.2.16-1 ~ * | cpe:/a:redhat:build_keycloak:26.2::el9 | |
| Red Hat | Red Hat build of Keycloak 26.2 | 26.2-21 ~ * | cpe:/a:redhat:build_keycloak:26.2::el9 | |
| Red Hat | Red Hat build of Keycloak 26.2 | 26.2-21 ~ * | cpe:/a:redhat:build_keycloak:26.2::el9 | |
| Red Hat | Red Hat build of Keycloak 26.2.16 | - | cpe:/a:redhat:build_keycloak:26.2::el9 | |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4.12-1 ~ * | cpe:/a:redhat:build_keycloak:26.4::el9 | |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-17 ~ * | cpe:/a:redhat:build_keycloak:26.4::el9 | |
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-17 ~ * | cpe:/a:redhat:build_keycloak:26.4::el9 | |
| Red Hat | Red Hat build of Keycloak 26.4.12 | - | cpe:/a:redhat:build_keycloak:26.4::el9 |
II. Public POCs for CVE-2026-7307
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-7307
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-7307 (6)
- 2476526 – (CVE-2026-7307) CVE-2026-7307 keycloak: Keycloak: Denial of Service via specially crafted SAML inputissue-trackingx_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-05-19 · 11 CVEs total
| CVE-2026-7504 | 8.1 HIGH | Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in k |
| CVE-2026-7507 | 7.5 HIGH | Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to accou |
| CVE-2026-7571 | 7.1 HIGH | Keycloak: keycloak: access token disclosure and implicit flow bypass via forged client dat |
| CVE-2026-37982 | 6.8 MEDIUM | Keycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauth |
| CVE-2026-4630 | 6.8 MEDIUM | Keycloak: keycloak: unauthorized resource access and data modification via insecure direct |
| CVE-2026-37979 | 6.5 MEDIUM | Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience |
| CVE-2026-8922 | 5.4 MEDIUM | Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org |
| CVE-2026-37978 | 4.9 MEDIUM | Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admi |
| CVE-2026-37981 | 4.3 MEDIUM | Keycloak: org.keycloak.authorization: keycloak: information disclosure via broken access c |
| CVE-2026-8830 | 4.3 MEDIUM | Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credenti |
IV. Related Vulnerabilities
Same product: Red Hat build of Keycloak 26.2
- CVE-2026-7507
Org.keycloak/keycloak-services: session fixation in oidc log - CVE-2026-7504
Org.keycloak/keycloak-services: open redirect when using wil - CVE-2026-4636
Keycloak: keycloak: uma policy bypass allows authenticated u - CVE-2026-4282
Keycloak: keycloak: privilege escalation via forged authoriz - CVE-2026-4325
Keycloak: keycloak: replay of action tokens via improper han
Same vendor: Red Hat
- CVE-2026-9149
Libsolv: heap buffer overflow in libsolv repo_add_solv via n - CVE-2026-9150
Libsolv: stack-based buffer overflow in libsolv's debian met - CVE-2026-9087
Keycloak: cross-session email verification proof not bound t - CVE-2026-9064
389-ds-base: 389-ds-base: unbounded ldap controls count in g - CVE-2026-7571
Keycloak: keycloak: access token disclosure and implicit flo
Same weakness: CWE-1286
- CVE-2026-0983
Denial of service vulnerability in M-Files Server - CVE-2026-6442
Improper Command Detection Logic Allows RCE in Cortex Code C - CVE-2026-40198
Net::CIDR::Lite versions before 0.23 for Perl does not valid - CVE-2026-33778
Junos OS: SRX Series, MX Series: When a specifically malform - CVE-2026-34835
Rack: `Rack::Request` accepts invalid Host characters, enabl
V. Comments for CVE-2026-7307
No comments yet