CVE WatchNov 5, 2026

CVE-2026-82965

A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolutio

CVSS

7.5

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 5, 2026 · Last modified: Nov 5, 2026 · CWE-400

EPSS · 30d

Not enough EPSS history yet.

Technical description

A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-494077.7 HIG

—

———OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.44, its local /ws/dictation WebSocket endpoint lacks client authentication and browser-origin validation. An unauthenticated client, including a malicious web page able to reach the endpoint, can submit audio and trigger resource-intensive speech-to-text processing. Earlier affected versions also accumulate audio in an unbounded buffer, allowing continuous streaming to exhaust process memory. These conditions can degrade performance, exhaust resources, or crash the application. This issue is fixed in version 0.57.44.5h CVE-2026-1109327.5 HIG

—

———A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by sending many requests with unique, fabricated theme names, leading to persistent disk space exhaustion that survives server restarts and causes service disruptions.3h CVE-2026-1071237.5 HIG

—

———A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution. The issue occurs when the server parses XML documents containing excessively long dateTime or duration values. Because these strings are not properly validated before processing, the XML parser consumes excessive CPU time. An unauthenticated remote attacker can exploit this by sending specially crafted SAML requests to the server, leading to high CPU utilization and a denial of service for all users.5h CVE-2026-74841—

—

———In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator for it before confirming the tenant existed. DelegatorFactory's internal cache retains every delegator name it is asked to resolve, including ones that fail to resolve, so an unauthenticated attacker could submit a stream of arbitrary tenant IDs to grow this cache without bound, driving unnecessary memory and database load.7h CVE-2026-33971—

—

——0In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.19h CVE-2026-1223096.2 MED

9.5%

——0Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespace-scoped policy authors to exhaust CPU and memory by submitting CEL expressions evaluated without runtime cost limits. Attackers can create a NamespacedValidatingPolicy or NamespacedDeletingPolicy with nested map comprehensions over large ConfigMap fields to OOM-kill Kyverno pods and block cluster-wide admission.7h