{"id":"CVE-2026-82965","kind":"vulnerability","aliases":["CVE-2026-82965"],"related":[],"title":"Keycloak: oversized SAML XML requests exhaust memory and crash login service","description":"A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users.","summary":"Keycloak's SAML Artifact Resolution and ECP SOAP endpoints do not limit the size or complexity of incoming XML, so large crafted messages consume excessive memory. An unauthenticated attacker can make the server run out of memory and crash, denying service to all users.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"keycloak-services","fixed":[],"affected":"unknown (Red Hat lists rhbk, keycloak-services, rhbk-openshift)","ecosystem":"vendor"}],"ecosystems":[],"tags":["denial-of-service","identity","keycloak","package","saml","self-hosted"],"not_affected_if":["managed-hosting","no-saml"],"how_to_check":"Check which Keycloak/RHBK version you run and watch Red Hat's CVE page and Bugzilla 2526302 for fixed builds. Check whether /realms/<realm>/protocol/saml paths (artifact resolution, ECP SOAP) are reachable from the internet via reverse proxy or load balancer config.","fix":null,"status":"open","published_at":"2026-11-05T17:18:21+00:00","first_seen_at":"2026-11-05T17:40:05+00:00","triaged_at":"2026-11-05T17:42:21+00:00","updated_at":"2026-11-05T17:44:03+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T17:42:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Keycloak: oversized SAML XML requests exhaust memory and crash login service","impact":"medium","summary":"Keycloak's SAML Artifact Resolution and ECP SOAP endpoints do not limit the size or complexity of incoming XML, so large crafted messages consume excessive memory. An unauthenticated attacker can make the server run out of memory and crash, denying service to all users.","audience":"businesses","category":"package","nicknames":[],"who_cares":["keycloak","self-hosted","saml","identity"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker crashes the identity server, denying login for all users","analyst_note":"Find the affected and fixed Keycloak versions in the NVD CPE ranges or the Keycloak security advisory for CVE-2026-82965.","how_to_check":"- Check the installed Keycloak version against the product ranges in the NVD entry.\n- Check whether SAML Artifact Resolution or ECP SOAP endpoints are reachable from the internet, for example by looking for `/saml` paths in your reverse proxy or load balancer logs.","plain_action":"","needs_analyst":true,"not_affected_if":["no-saml","managed-hosting"],"who_is_affected":"Organisations running self-hosted Keycloak with SAML federation enabled and the SAML Artifact Resolution or ECP SOAP endpoints exposed. The sources do not state the affected version ranges or a fixed version. Deployments that do not use SAML, or that keep these endpoints off the public internet, are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00073,"input_tokens":4271,"output_tokens":605,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Keycloak versions in the NVD CPE ranges or the Keycloak security advisory for CVE-2026-82965.","search":"'-2026':13A,16A '-82965':14A,17A 'access':92C 'applic':141C 'artifact':35B,97C 'attack':60B,118C 'caus':130C 'complex':47B,110C 'consum':55B,134C 'craft':53B,125C 'crash':9A,70B,147C 'cve':12A,15A 'deni':71B 'denial':22B,151C 'denial-of-servic':21B 'ecp':38B,100C 'endpoint':40B,102C 'excess':56B,135C 'exhaust':6A 'exploit':120C 'flaw':77C 'found':79C 'host':31B 'ident':25B,90C 'implement':83C 'incom':49B,112C 'keycloak':1A,19A,26B,32B,85C 'keycloak-services':18A 'larg':52B,126C 'lead':138C 'limit':43B,106C 'login':10A 'make':62B 'manag':93C 'memori':7A,57B,68B,136C,145C 'messag':54B,128C 'open':88C 'open-sourc':87C 'overs':2A 'packag':27B 'proper':105C 'remot':117C 'request':5A,114C 'resolut':36B,98C 'result':148C 'run':65B,142C 'saml':3A,28B,34B,82C,96C 'self':30B 'self-host':29B 'send':123C 'server':64B,132C 'servic':11A,24B,72B,153C 'services':20A 'size':45B,108C 'soap':39B,101C 'solut':94C 'sourc':89C 'special':124C 'unauthent':59B,116C 'user':75B,156C 'xml':4A,50B,113C,127C","nicknames":[],"mitigations":[],"who_affected":"Keycloak servers (Red Hat build of Keycloak / keycloak-services) that expose SAML Artifact Resolution or ECP SOAP endpoints to untrusted clients. An unauthenticated attacker can send large XML to exhaust memory and crash the server, locking out all users. Deployments not using SAML or with those endpoints not reachable from untrusted networks can largely skip it. Exact affected and fixed versions are not yet published.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["keycloakservices"],"ptokens":["keycloak","services"],"labels":["denialofservice","high","identity","keycloak","package","saml","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T17:18:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82965","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82965","severity":null,"published_at":"2026-11-05T17:18:21+00:00","modified_at":"2026-11-05T17:18:22+00:00","first_seen_at":"2026-11-05T17:40:05+00:00","fetched_at":"2026-11-05T17:40:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-82965:1800","url":"https://access.redhat.com/security/cve/cve-2026-82965","severity":null,"published_at":"2026-11-05T17:44:03+00:00","modified_at":"2026-11-05T17:44:03+00:00","first_seen_at":"2026-11-05T17:44:03+00:00","fetched_at":"2026-11-05T17:44:03+00:00","note":"Red Hat advisory read (CVSS 7.5, Important, no mitigation, no fixed version published). Keycloak upstream advisory/fixed version not found; 26.8.2 notes list a different CVE (CVE-2026-107123) so not assumed same.","cites":["https://access.redhat.com/security/cve/cve-2026-82965"]}],"documents":[{"id":78325,"url":"https://access.redhat.com/security/cve/cve-2026-82965","title":"CVE-2026-82965 - Red Hat Customer Portal","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}