CVE-2026-7307
- Source
- https://cve.org/CVERecord?id=CVE-2026-7307
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-7307.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-7307
- Aliases
- Downstream
CGA (24)
- CGA-2c8c-w76r-gqjv
- CGA-3vqw-rppr-xvwv
- CGA-4vp5-p3jp-w3vf
- CGA-5h3w-j9fr-cvm8
- CGA-5m8c-pwgr-4qw3
- CGA-66jr-7vrm-r863
- CGA-765w-jj6h-9rgp
- CGA-8w6q-jgmg-5j4h
- CGA-92gf-72rg-5vm9
- CGA-c7hm-76gv-xq4q
- CGA-cv2x-4532-j946
- CGA-f4p6-fjg5-v3gq
- CGA-fg79-p3ww-874p
- CGA-fxxj-fgfm-f3v4
- CGA-hcjh-fj5r-cwhw
- CGA-m67r-2m77-7xc8
- CGA-m6qv-p455-x3m8
- CGA-p3v4-xg44-qwrw
- CGA-p5c9-q7pp-gmxf
- CGA-qhxg-3r2h-84j8
- CGA-r6h2-x7j8-wx6x
- CGA-rjwq-v242-fhpc
- CGA-rvp7-3j8m-fv22
- CGA-x9wq-pxvc-j4xv
ECHO (1)
- Published
- 2026-05-19T10:52:24Z
- Modified
- 2026-10-08T02:30:51Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Keycloak: keycloak: denial of service via specially crafted saml input
- Details
-
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.
- Database specific
{ "cna_assigner": "redhat", "cwe_ids": [ "CWE-1286" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7307.json" }- References
-
- https://access.redhat.com/downloads/content/package-browser/
- https://catalog.redhat.com/software/containers/
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7307.json
- https://access.redhat.com/errata/RHSA-2026:19594
- https://access.redhat.com/errata/RHSA-2026:19595
- https://access.redhat.com/errata/RHSA-2026:19596
- https://access.redhat.com/errata/RHSA-2026:19597
- https://access.redhat.com/errata/RHSA-2026:76128
- https://access.redhat.com/errata/RHSA-2026:76129
- https://access.redhat.com/errata/RHSA-2026:76130
- https://access.redhat.com/errata/RHSA-2026:76132
- https://access.redhat.com/errata/RHSA-2026:76134
- https://access.redhat.com/security/cve/CVE-2026-7307
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7307.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-7307
- https://bugzilla.redhat.com/show_bug.cgi?id=2476526
- https://github.com/keycloak/keycloak
Affected packages
Git / github.com/keycloak/keycloak
Affected ranges
- Type
- GIT
- Repo
- https://github.com/keycloak/keycloak
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "26.2.16" }, { "fixed": "26.4.12" }, { "fixed": "26.6.2" } ], "source": "AFFECTED_FIELD" }