---
id: "CVE-2026-107123"
kind: "vulnerability"
aliases: ["CVE-2026-107123"]
title: "Keycloak: long SAML dateTime values exhaust CPU and cause denial of service"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "keycloak-services", "fixed": [], "affected": "unknown", "ecosystem": "maven"}]
ecosystems: []
tags: ["identity", "keycloak", "runtime", "saml", "self-hosted"]
not_affected_if: ["managed-hosting", "saml-disabled"]
published_at: "2026-11-05T17:17:34+00:00"
first_seen_at: "2026-11-05T17:40:03+00:00"
updated_at: "2026-11-05T17:47:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107123", "first_seen_at": "2026-11-05T17:40:03+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/cve-2026-107123", "first_seen_at": "2026-11-05T17:47:16+00:00", "cites": ["https://access.redhat.com/security/cve/cve-2026-107123", "http://hol.org/guard/security/cves/CVE-2026-107123-keycloak-services-keycloak-services"]}]
exploit_sources: []
---

# Keycloak: long SAML dateTime values exhaust CPU and cause denial of service

Keycloak's SAML XML parser spends excessive CPU time on overly long dateTime or duration values in crafted requests. An unauthenticated remote attacker can send such SAML requests to drive CPU use up and deny service to all users.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:keycloak-services affected unknown fixed no fixed version listed

## How to check

- Find your Keycloak version (admin console footer or 'kc.sh --version') and compare to the Keycloak/Red Hat advisory when ranges are published (none found yet)
- Check whether any realm has SAML clients or SAML identity providers and whether the SAML endpoints (/realms/<realm>/protocol/saml) are reachable from untrusted networks
- Watch for sustained high CPU on Keycloak pods right after SAML requests

## Timeline

- 2026-11-05T17:40:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107123
- 2026-11-05T17:47:16+00:00 analyst https://access.redhat.com/security/cve/cve-2026-107123 — Red Hat CVE page (CNA) read: unauthenticated CPU DoS via overlong SAML XML dateTime/duration values, CVSS 7.5, Red Hat says Important, no mitigation. No affected/fixed Keycloak versions published anywhere I could reach (NVD page returned empty, keycloak.org/security is only policy). Fix left unknown; nothing verified. Not exploited per sources. X not checked.

## Documents

- [advisory] Red Hat CVE-2026-107123 https://access.redhat.com/security/cve/cve-2026-107123
- [mentions] HOL Guard record CVE-2026-107123 http://hol.org/guard/security/cves/CVE-2026-107123-keycloak-services-keycloak-services

## From the sources

A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution. The issue occurs when the server parses XML documents containing excessively long dateTime or duration values. Because these strings are not properly validated before processing, the XML parser consumes excessive CPU time. An unauthenticated remote attacker can exploit this by sending specially crafted SAML requests to the server, leading to high CPU utilization and a denial of service for all users.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_