Security feed

24 October 2026

advisoryOfficial CVE List24 Oct 2026

Keycloak: keycloak: denial of service due to excessive samlrequest decompression

A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-2575

Red Hat build of Keycloak 26.4

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4.10

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6.13

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6 for RHEL 7

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6 for RHEL 8

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6 for RHEL 9

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

RHEL-8 based Middleware Containers

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-2575
Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event: #9448 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:17:53 GMT
Publisher date: Wed, 18 Mar 2026 03:19:09 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover

A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which processes session handles without adequate CSRF protection or cookie ownership validation—an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim's credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts.

Red Hat build of Keycloak 26.2 Red Hat build of Keycloak 26.2 Red Hat build of Keycloak 26.2 Red Hat build of Keycloak 26.2.16 Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.4.12 Red Hat Single Sign-On 7.6.13 Red Hat Single Sign-On 7.6 for RHEL 7 Red Hat Single Sign-On 7.6 for RHEL 8 Red Hat Single Sign-On 7.6 for RHEL 9 RHEL-8 based Middleware Containers CVE-2026-7507

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-7507

Red Hat build of Keycloak 26.2

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.2

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.2

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.2.16

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4.12

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6.13

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6 for RHEL 7

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6 for RHEL 8

Source reference: /containers/cna/affected/10/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6 for RHEL 9

Source reference: /containers/cna/affected/11/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

RHEL-8 based Middleware Containers

Source reference: /containers/cna/affected/12/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-7507
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #9418 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:17:33 GMT
Publisher date: Tue, 19 May 2026 11:01:25 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource consumption and prolonged processing times, ultimately resulting in a Denial of Service (DoS) for the Keycloak server.

Red Hat build of Keycloak 26.2 Red Hat build of Keycloak 26.2 Red Hat build of Keycloak 26.2 Red Hat build of Keycloak 26.2.15 Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.4.11 Red Hat Single Sign-On 7.6.13 Red Hat Single Sign-On 7.6 for RHEL 7 Red Hat Single Sign-On 7.6 for RHEL 8 Red Hat Single Sign-On 7.6 for RHEL 9 RHEL-8 based Middleware Containers CVE-2026-4634

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-4634

Red Hat build of Keycloak 26.2

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.2

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.2

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.2.15

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4.11

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6.13

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6 for RHEL 7

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6 for RHEL 8

Source reference: /containers/cna/affected/10/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6 for RHEL 9

Source reference: /containers/cna/affected/11/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

RHEL-8 based Middleware Containers

Source reference: /containers/cna/affected/12/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-4634
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #9417 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:17:32 GMT
Publisher date: Thu, 02 Apr 2026 12:44:53 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Red Hat build of Keycloak 26.2 Red Hat build of Keycloak 26.2 Red Hat build of Keycloak 26.2 Red Hat build of Keycloak 26.2.14 Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.4.10 Red Hat Single Sign-On 7.6.13 Red Hat Single Sign-On 7.6 for RHEL 7 Red Hat Single Sign-On 7.6 for RHEL 8 Red Hat Single Sign-On 7.6 for RHEL 9 RHEL-8 based Middleware Containers CVE-2026-2092

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-2092

Red Hat build of Keycloak 26.2

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.2

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.2

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.2.14

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4.10

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6.13

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6 for RHEL 7

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6 for RHEL 8

Source reference: /containers/cna/affected/10/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6 for RHEL 9

Source reference: /containers/cna/affected/11/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

RHEL-8 based Middleware Containers

Source reference: /containers/cna/affected/12/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-2092
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #9416 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:17:32 GMT
Publisher date: Wed, 18 Mar 2026 01:14:48 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Keycloak: keycloak: denial of service via specially crafted saml input

A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-7307

Red Hat build of Keycloak 26.2

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.2

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.2

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.2.16

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4.12

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6.13

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6 for RHEL 7

Source reference: /containers/cna/affected/10/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6 for RHEL 8

Source reference: /containers/cna/affected/11/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6 for RHEL 9

Source reference: /containers/cna/affected/12/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

RHEL-8 based Middleware Containers

Source reference: /containers/cna/affected/13/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-7307
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #9402 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 23:17:23 GMT
Publisher date: Tue, 19 May 2026 10:52:24 GMT

Read the original announcement

advisoryOfficial CVE List24 Oct 2026

Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them in a permanent in-memory cache without limits. An attacker can exploit this by sending a large number of unique locale tags, eventually causing the server to run out of memory and crash.

Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.4.16 Red Hat build of Keycloak 26.4.16 Red Hat build of Keycloak 26.4.16 Red Hat build of Keycloak 26.6 Red Hat build of Keycloak 26.6 Red Hat build of Keycloak 26.6 Red Hat build of Keycloak 26.6.7 Red Hat build of Keycloak 26.6.7 Red Hat build of Keycloak 26.6.7 Red Hat Single Sign-On 7 CVE-2026-79651

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-79651

Red Hat build of Keycloak 26.4

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4.16

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4.16

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.4.16

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.6

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.6

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.6

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.6.7

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.6.7

Source reference: /containers/cna/affected/10/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Keycloak 26.6.7

Source reference: /containers/cna/affected/11/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7

Source reference: /containers/cna/affected/12/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2026-79651
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #1994 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:11:10 GMT
Publisher date: Wed, 16 Sep 2026 14:55:09 GMT

Read the original announcement