Keycloak Denial-of-Service Vulnerability via Crafted SAML XML Input

A denial-of-service vulnerability has been identified in Keycloak. It allows remote, unauthenticated attackers to send specially crafted XML to the SAML endpoint. This malicious input can lead to high CPU usage and exhaustion of worker threads, causing the Keycloak server to become unavailable. The vulnerability affects all Keycloak versions on Linux.

Impact

Exploitation of this vulnerability leads to a significant denial-of-service condition, causing the Keycloak server to become unavailable. This issue directly impacts Keycloak instances with the SAML protocol enabled.

Remediation

To mitigate this vulnerability, restrict network access to the Keycloak SAML endpoint from untrusted sources. Implement firewall rules to limit inbound connections to the Keycloak service port from untrusted networks. If SAML is not needed, consider disabling it to reduce the attack surface. These changes may require a restart or reload of the Keycloak service.