7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-7307

CVE-2026-7307: Keycloak: keycloak: denial of service via specially crafted saml input

A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-7307

CVE-2026-7307:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.keycloak:keycloak-saml-core	maven	< 26.6.2	26.6.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Denial of Service in Keycloak's SAML processing component. An unauthenticated attacker can send a specially crafted, malformed SAML 1.1 XML document to a SAML endpoint. This triggers a flaw in the XML parsing logic, causing an infinite loop and high CPU consumption, which ultimately makes the server unresponsive.

The root cause of the vulnerability lies in several parsing methods within the org.keycloak.saml.processing.core.parsers.util.SAML11ParserUtil class. The analysis of the fixing commit be84d28ce4c69c038d542f11405d5ede1d61f4a9 shows that functions responsible for parsing specific SAML 1.1 elements (SubjectConfirmation, AttributeQuery, AuthenticationQuery, and AuthorizationDecisionQuery) did not properly handle cases where unexpected text content was present instead of the expected XML child elements. This led to a state where the XML event parser would not advance, resulting in an infinite loop within the parsing function.

The patch rectifies this by adding a crucial else block to the parsing loop. This block checks for unexpected XML event types and throws a ParsingException if one is found, thus terminating the process and preventing the Denial of Service. The identified vulnerable functions are the ones that contained this flawed parsing logic and would appear in a runtime profile with high CPU usage during an exploit.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.