CVE-2026-82965

HighCVSS 7.5/10Last modified Nov 6, 2026

Description

A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 5, 2026
Last modified: Nov 6, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-829679.8IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-base CVE-2026-829686.4A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider ac CVE-2026-829695.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bimser Solution Software Trade Inc. EB CVE-2026-82979.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting CVE-2026-8297010.0Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Us CVE-2026-8297110.0A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the CVE-2026-829739.4Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticate CVE-2026-829767.1A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP f CVE-2026-829784.3An authorization bypass in channel-edit.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to create a delivery rule s CVE-2026-829806.3Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves f CVE-2026-829824.3The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from app CVE-2026-829833.3The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level pe