MEDIUM6.5
GHSA-w97f-w3hq-36g2
Keycloak Denial of Service vulnerability
Quick fix
GHSA-w97f-w3hq-36g2 — org.keycloak:keycloak-core: upgrade to the fixed version with the command below.
# pom.xml: bump <version>24.0.0</version> for org.keycloak:keycloak-coreDetails
A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited, an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values. The issue is fixed in Keycloak 24 with the introduction of the User Profile feature.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.keycloak:keycloak-core
Introduced in:
0Fixed in: 24.0.0Fix
# pom.xml: bump <version>24.0.0</version> for org.keycloak:keycloak-coreReferences
- https://nvd.nist.gov/vuln/detail/CVE-2023-6841[ADVISORY]
- https://github.com/keycloak/keycloak/issues/32837[WEB]
- https://access.redhat.com/security/cve/CVE-2023-6841[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=2254714[WEB]
- https://github.com/keycloak/keycloak[PACKAGE]
- https://github.com/keycloak/keycloak/releases/tag/24.0.0[WEB]