GHSA-w97f-w3hq-36g2

Keycloak Denial of Service vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2023-6841

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.keycloak:keycloak-core	< 24.0.0	24.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited, an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values. The issue is fixed in Keycloak 24 with the introduction of the User Profile feature.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-6841 advisory
https://github.com/keycloak/keycloak/issues/32837 web
https://access.redhat.com/security/cve/CVE-2023-6841 web
https://bugzilla.redhat.com/show_bug.cgi?id=2254714 web
https://github.com/keycloak/keycloak package
https://github.com/keycloak/keycloak/releases/tag/24.0.0 web