{"id":"CVE-2026-107123","kind":"vulnerability","aliases":["CVE-2026-107123"],"related":[],"title":"Keycloak: long SAML dateTime values exhaust CPU and cause denial of service","description":"A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution. The issue occurs when the server parses XML documents containing excessively long dateTime or duration values. Because these strings are not properly validated before processing, the XML parser consumes excessive CPU time. An unauthenticated remote attacker can exploit this by sending specially crafted SAML requests to the server, leading to high CPU utilization and a denial of service for all users.","summary":"Keycloak's SAML XML parser spends excessive CPU time on overly long dateTime or duration values in crafted requests. An unauthenticated remote attacker can send such SAML requests to drive CPU use up and deny service to all users.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"keycloak-services","fixed":[],"affected":"unknown","ecosystem":"maven"}],"ecosystems":[],"tags":["identity","keycloak","runtime","saml","self-hosted"],"not_affected_if":["managed-hosting","saml-disabled"],"how_to_check":"- Find your Keycloak version (admin console footer or 'kc.sh --version') and compare to the Keycloak/Red Hat advisory when ranges are published (none found yet)\n- Check whether any realm has SAML clients or SAML identity providers and whether the SAML endpoints (/realms/<realm>/protocol/saml) are reachable from untrusted networks\n- Watch for sustained high CPU on Keycloak pods right after SAML requests","fix":null,"status":"open","published_at":"2026-11-05T17:17:34+00:00","first_seen_at":"2026-11-05T17:40:03+00:00","triaged_at":"2026-11-05T17:42:29+00:00","updated_at":"2026-11-05T17:47:16+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-05T17:42:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Keycloak: long SAML dateTime values exhaust CPU and cause denial of service","impact":"medium","summary":"Keycloak's SAML XML parser spends excessive CPU time on overly long dateTime or duration values in crafted requests. An unauthenticated remote attacker can send such SAML requests to drive CPU use up and deny service to all users.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["keycloak","self-hosted","saml","identity"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Server CPU exhausted, denying login service to all users","analyst_note":"Find the affected and fixed Keycloak versions and any SAML-specific configuration for this CVE in the NVD entry or the Keycloak security advisory.","how_to_check":"- Check whether the Keycloak SAML identity provider or SAML client is enabled in the realm settings\n- Check the running Keycloak version, for example with `kc.sh --version` or the admin console footer\n- unknown for affected version ranges, since the sources give no product ranges","plain_action":"","needs_analyst":true,"not_affected_if":["saml-disabled","managed-hosting"],"who_is_affected":"Organizations running Keycloak as an identity provider with the SAML protocol enabled are exposed, since the flaw is reached by unauthenticated SAML requests to the server. Deployments that do not use SAML, or that sit behind a gateway blocking those endpoints, are less exposed. The sources do not name affected versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000721,"input_tokens":4270,"output_tokens":587,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Keycloak versions and any SAML-specific configuration for this CVE in the NVD entry or the Keycloak security advisory.","search":"'-107123':15A,18A '-2026':14A,17A 'access':86C 'attack':51B,124C 'caus':9A 'compon':77C 'consum':117C 'contain':98C 'cpu':7A,36B,59B,119C,140C 'craft':46B,131C 'cve':13A,16A 'datetim':4A,41B,101C 'deni':63B 'denial':10A,144C 'document':97C 'drive':58B 'durat':43B,103C 'excess':35B,99C,118C 'exhaust':6A 'exploit':126C 'flaw':69C 'found':71C 'high':139C 'host':28B 'ident':22B,84C 'issu':90C 'keycloak':1A,20A,23B,29B,79C 'keycloak-services':19A 'lead':137C 'long':2A,40B,100C 'manag':87C 'occur':91C 'open':82C 'open-sourc':81C 'over':39B 'pars':95C 'parser':33B,116C 'process':76C,113C 'proper':110C 'remot':50B,123C 'request':47B,56B,133C 'runtim':24B 'saml':3A,25B,31B,55B,74C,132C 'self':27B 'self-host':26B 'send':53B,129C 'server':94C,136C 'servic':12A,64B,146C 'services':21A 'solut':88C 'sourc':83C 'special':130C 'spend':34B 'string':107C 'time':37B,120C 'unauthent':49B,122C 'use':60B 'user':67B,149C 'util':141C 'valid':111C 'valu':5A,44B,104C 'xml':32B,75C,96C,115C","nicknames":[],"mitigations":[],"who_affected":"Keycloak servers (upstream keycloak-services and Red Hat build of Keycloak, rhbk/keycloak-rhel9, as mapped by Red Hat) that accept SAML requests from the network. The attacker needs no login. Versions are not yet published, so treat any self-hosted Keycloak with reachable SAML endpoints as possibly exposed until ranges are stated. Deployments that do not expose SAML endpoints are less likely to be reachable, but the vendor does not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["keycloakservices"],"ptokens":["keycloak","services"],"labels":["high","identity","keycloak","runtime","saml","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T17:17:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107123","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107123","severity":null,"published_at":"2026-11-05T17:17:34+00:00","modified_at":"2026-11-05T17:17:35+00:00","first_seen_at":"2026-11-05T17:40:03+00:00","fetched_at":"2026-11-05T17:40:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-107123:1809","url":"https://access.redhat.com/security/cve/cve-2026-107123","severity":null,"published_at":"2026-11-05T17:47:16+00:00","modified_at":"2026-11-05T17:47:16+00:00","first_seen_at":"2026-11-05T17:47:16+00:00","fetched_at":"2026-11-05T17:47:16+00:00","note":"Red Hat CVE page (CNA) read: unauthenticated CPU DoS via overlong SAML XML dateTime/duration values, CVSS 7.5, Red Hat says Important, no mitigation. No affected/fixed Keycloak versions published anywhere I could reach (NVD page returned empty, keycloak.org/security is only policy). Fix left unknown; nothing verified. Not exploited per sources. X not checked.","cites":["https://access.redhat.com/security/cve/cve-2026-107123","http://hol.org/guard/security/cves/CVE-2026-107123-keycloak-services-keycloak-services"]}],"documents":[{"id":78378,"url":"https://access.redhat.com/security/cve/cve-2026-107123","title":"Red Hat CVE-2026-107123","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":78379,"url":"http://hol.org/guard/security/cves/CVE-2026-107123-keycloak-services-keycloak-services","title":"HOL Guard record CVE-2026-107123","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}