GHSA-2935-2wfm-hhpv
Keycloak Denial of Service (DoS) Vulnerability via JWT Token Cache
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.keycloak:keycloak-services | <= 26.1.4 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens with an excessively long expiration time, for example, 24 or 48 hours, the cache can grow indefinitely, leading to an OutOfMemoryError. This issue could result in a denial of service condition, preventing legitimate users from accessing the system.
References
External links from the advisory. They lead to third-party sites.