Veille CVE
CVE-2026-7307
7.5 ÉlevéeDescription
A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML) endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) where the server becomes unavailable.
Produits concernés
- Red Hat build of Keycloak 26.2
- Red Hat build of Keycloak 26.2.16
- Red Hat build of Keycloak 26.4
- Red Hat build of Keycloak 26.4.12
- Red Hat Single Sign-On 7.6.13
- Red Hat Single Sign-On 7.6 for RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 9
- Red Hat RHEL-8 based Middleware Containers
- Redhat build of keycloak
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 7.5 Élevée | secalert@redhat.com | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | 7.5 Élevée | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Faiblesses (CWE)
Références
- https://access.redhat.com/errata/RHSA-2026:19594 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:19595 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:19596 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:19597 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:76128
- https://access.redhat.com/errata/RHSA-2026:76129
- https://access.redhat.com/errata/RHSA-2026:76130
- https://access.redhat.com/errata/RHSA-2026:76132
- https://access.redhat.com/errata/RHSA-2026:76134
- https://access.redhat.com/security/cve/CVE-2026-7307 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2476526 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:19594 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:19595 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:19596 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:19597 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-7307 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2476526 Vendor Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7307.json