Is CVE-2026-110931 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110931 being exploited in the wild.

How severe is CVE-2026-110931?

High severity, with a CVSS score of 7.5, published 5 November 2026.

Is there a fix for CVE-2026-110931?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-110931 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-110931?

Check whether you run Red Hat Keycloak. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110931: Keycloak SAML 1.1 assertion parser infinite loop denial of service

CVE-2026-110931 · Severity: high · CVSS 7.5 · Published 2026-11-05

Keycloak is an identity and access management system that handles user authentication and authorization for enterprise applications. A flaw in its SAML 1.1 parser can be exploited by an unauthenticated attacker to crash the entire service by sending a specially crafted authentication request, making the system unavailable to all legitimate users until it is restarted.

Technologies: Red Hat Keycloak. Vendors: Red Hat.

Quick answers

Is CVE-2026-110931 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110931 being exploited in the wild.
How severe is CVE-2026-110931?: High severity, with a CVSS score of 7.5, published 5 November 2026.
Which products and versions are affected?: Red Hat Keycloak.
Is there a fix for CVE-2026-110931?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-110931 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-110931?: Check whether you run Red Hat Keycloak. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an infinite loop in the SAML 1.1 AuthorityBinding parsing logic (CWE-835) that results from an incomplete fix for a prior vulnerability. An unauthenticated, remote attacker can trigger memory exhaustion and JVM termination by sending a single malicious SAML assertion, causing complete service unavailability. No mitigation is available according to Red Hat; upgrading to a patched version is required.

Affected products

Red Hat Keycloak

Timeline

2026-11-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.