KEYCLOAK-SERVICES · CVE-2026-82965 · Package
NO FIX YET
Keycloak's SAML Artifact Resolution and ECP SOAP endpoints do not limit the size or complexity of incoming XML, so large crafted messages consume excessive memory. An unauthenticated attacker can make the server run out of memory and crash, denying service to all users.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Keycloak servers (Red Hat build of Keycloak / keycloak-services) that expose SAML Artifact Resolution or ECP SOAP endpoints to untrusted clients. An unauthenticated attacker can send large XML to exhaust memory and crash the server, locking out all users. Deployments not using SAML or with those endpoints not reachable from untrusted networks can largely skip it. Exact affected and fixed versions are not yet published.
Not affected if managed-hosting, no-saml
Who cares denial-of-service, identity, keycloak, saml, self-hosted
No fix yet, per the sources.
A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.