---
id: "CVE-2026-82965"
kind: "vulnerability"
aliases: ["CVE-2026-82965"]
title: "Keycloak: oversized SAML XML requests exhaust memory and crash login service"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "keycloak-services", "fixed": [], "affected": "unknown (Red Hat lists rhbk, keycloak-services, rhbk-openshift)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["denial-of-service", "identity", "keycloak", "package", "saml", "self-hosted"]
not_affected_if: ["managed-hosting", "no-saml"]
published_at: "2026-11-05T17:18:21+00:00"
first_seen_at: "2026-11-05T17:40:05+00:00"
updated_at: "2026-11-05T17:44:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82965", "first_seen_at": "2026-11-05T17:40:05+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/cve-2026-82965", "first_seen_at": "2026-11-05T17:44:03+00:00", "cites": ["https://access.redhat.com/security/cve/cve-2026-82965"]}]
exploit_sources: []
---

# Keycloak: oversized SAML XML requests exhaust memory and crash login service

Keycloak's SAML Artifact Resolution and ECP SOAP endpoints do not limit the size or complexity of incoming XML, so large crafted messages consume excessive memory. An unauthenticated attacker can make the server run out of memory and crash, denying service to all users.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:keycloak-services affected unknown (Red Hat lists rhbk, keycloak-services, rhbk-openshift) fixed no fixed version listed

## How to check

Check which Keycloak/RHBK version you run and watch Red Hat's CVE page and Bugzilla 2526302 for fixed builds. Check whether /realms/<realm>/protocol/saml paths (artifact resolution, ECP SOAP) are reachable from the internet via reverse proxy or load balancer config.

## Timeline

- 2026-11-05T17:40:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82965
- 2026-11-05T17:44:03+00:00 analyst https://access.redhat.com/security/cve/cve-2026-82965 — Red Hat advisory read (CVSS 7.5, Important, no mitigation, no fixed version published). Keycloak upstream advisory/fixed version not found; 26.8.2 notes list a different CVE (CVE-2026-107123) so not assumed same.

## Documents

- [advisory] CVE-2026-82965 - Red Hat Customer Portal https://access.redhat.com/security/cve/cve-2026-82965

## From the sources

A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_