MEDIUM6.5
GHSA-wq8x-cg39-8mrr
org.keycloak:keycloak-services has Inefficient Regular Expression Complexity
Quick fix
GHSA-wq8x-cg39-8mrr — org.keycloak:keycloak-services: upgrade to the fixed version with the command below.
# pom.xml: bump <version>24.0.9</version> for org.keycloak:keycloak-servicesDetails
A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.keycloak:keycloak-services
Introduced in:
0Fixed in: 24.0.9Fix
# pom.xml: bump <version>24.0.9</version> for org.keycloak:keycloak-servicesMaven/org.keycloak:keycloak-services
Introduced in:
25.0.0Fixed in: 26.0.6Fix
# pom.xml: bump <version>26.0.6</version> for org.keycloak:keycloak-servicesReferences
- https://github.com/keycloak/keycloak/security/advisories/GHSA-wq8x-cg39-8mrr[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2024-10270[ADVISORY]
- https://github.com/keycloak/keycloak/commit/5d6c91f3309db468b0fe4834e88c3d25649f73e4[WEB]
- https://access.redhat.com/errata/RHSA-2024:10175[WEB]
- https://access.redhat.com/errata/RHSA-2024:10176[WEB]
- https://access.redhat.com/errata/RHSA-2024:10177[WEB]
- https://access.redhat.com/errata/RHSA-2024:10178[WEB]
- https://access.redhat.com/security/cve/CVE-2024-10270[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=2321214[WEB]
- https://github.com/keycloak/keycloak[PACKAGE]