CVE-2026-7307CWE-1286

CVE-2026-7307

High · published May 19, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
62.8
In the wild
Unconfirmed
What it is

A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01010 · 62.8th percentile
Weakness
CWE-1286 · Improper Validation of Syntactic Correctness of Input
Published
2026-05-19T16:16Z
Affected products (1)
ProductVersionsFixed in
redhat/build_of_keycloak≥ 26.4, < 26.4.1226.4.12
References (18)
https://access.redhat.com/errata/RHSA-2026:19594 · [email protected]https://access.redhat.com/errata/RHSA-2026:19595 · [email protected]https://access.redhat.com/errata/RHSA-2026:19596 · [email protected]https://access.redhat.com/errata/RHSA-2026:19597 · [email protected]https://access.redhat.com/errata/RHSA-2026:76128 · [email protected]https://access.redhat.com/errata/RHSA-2026:76129 · [email protected]https://access.redhat.com/errata/RHSA-2026:76130 · [email protected]https://access.redhat.com/errata/RHSA-2026:76132 · [email protected]https://access.redhat.com/errata/RHSA-2026:76134 · [email protected]https://access.redhat.com/security/cve/CVE-2026-7307 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2476526 · [email protected]https://access.redhat.com/errata/RHSA-2026:19594 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:19595 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:19596 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:19597 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/security/cve/CVE-2026-7307 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://bugzilla.redhat.com/show_bug.cgi?id=2476526 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7307.json · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
EPSS history
Timeline
  • 19 MAY 10:52Z
    Keycloak: keycloak: denial of service via specially crafted saml input
    cvelistv5