A flaw was found in Keycloak's SAML 1.1 XML parsing logic within the keycloak-saml-core component. When parsing the ds:KeyInfo element in SAML 1.1 assertions, the StAX-based parser loops over child elements but only contains logic to handle specific expected tags such as ds:EncryptedKey, ds:X509Data, and ds:KeyValue. The parser lacks a fallback branch to consume or reject other valid child elements like ds:KeyName. Consequently, the parser repeatedly peeks at the unhandled element without advancing, causing the processing thread to enter an infinite loop spinning at 100% CPU.
An unauthenticated remote attacker can exploit this by sending crafted SAML requests to Keycloak's SAML endpoints (e.g., /realms/{realm}/protocol/saml). By sending multiple concurrent requests, an attacker can exhaust the worker thread pool, resulting in a permanent denial of service until the server is manually restarted.