Bug 2553047 (CVE-2026-110931)

Summary:	CVE-2026-110931 keycloak-services: keycloak-services: Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, security-response-team, ssilvert, sthorger, vmuzikar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2027-01-12

Description OSIDB Bzimport 2026-10-15 05:37:20 UTC

A flaw was found in the SAML 1.1 assertion parser within the keycloak-saml-core library. The vulnerability is an infinite loop triggered when an AuthenticationStatement contains an AuthorityBinding child element. The parser fails to advance past this element, repeatedly processing it and growing an internal list until the Java heap is exhausted. This leads to a java.lang.OutOfMemoryError and immediate JVM termination. This issue represents an incomplete fix for CVE-2026-7307. A remote, unauthenticated attacker can exploit this by sending a single specially crafted SAML request to the realm SAML endpoint or the SAML identity provider broker endpoint. Successful exploitation allows an attacker to stop the Keycloak node completely, preventing all logins, token issuance, and administrative functions until the process is manually restarted.