Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2023-6841

Keycloak: amount of attributes per object is not limited and it may lead to dos

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

keycloak

Default version status: unaffected

  • 0 to < 24.0.0affected

Red Hat Red Hat build of Quarkus

Default version status: unaffected

Red Hat Red Hat Fuse 7

Default version status: unaffected

Red Hat Red Hat Mobile Application Platform 4

Default version status: unaffected

Red Hat Red Hat OpenShift Application Runtimes

Default version status: unaffected

Red Hat Red Hat Process Automation 7

Default version status: unaffected

Red Hat Red Hat Single Sign-On 7

Default version status: affected

Red Hat Red Hat support for Spring Boot

Default version status: unaffected

References