Skip to content
OpenAdvisories
High · 7.5 CVE-2026-110931 EUVD-2026-117566GHSA-w9c8-6pxq-5xf8

Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loop

Published Nov 5, 2026 · Updated Nov 9, 2026 · Assigned by redhat

Description

A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat build of Keycloak 26.4 — —
Red Hat Red Hat build of Keycloak 26.4.17 — —
Red Hat Red Hat build of Keycloak 26.6 — —
Red Hat Red Hat build of Keycloak 26.6.8 — —
Red Hat Red Hat Single Sign-On 7 — —

Advisories 1

References