{"id":"CVE-2023-6841","state":"PUBLISHED","title":"Keycloak: amount of attributes per object is not limited and it may lead to dos","description":"A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.","publishedAt":"2024-09-10T16:15:32.639Z","updatedAt":"2025-11-08T07:10:39.283Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["keycloak","Red Hat Red Hat build of Quarkus","Red Hat Red Hat Fuse 7","Red Hat Red Hat Mobile Application Platform 4","Red Hat Red Hat OpenShift Application Runtimes","Red Hat Red Hat Process Automation 7","Red Hat Red Hat Single Sign-On 7","Red Hat Red Hat support for Spring Boot"],"affected":[{"packageName":"keycloak","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"24.0.0","versionType":"semver"}],"collectionURL":"https://github.com/keycloak/keycloak"},{"vendor":"Red Hat","product":"Red Hat build of Quarkus","packageName":"keycloak","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_application_runtimes:1.0"]},{"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"keycloak","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_fuse:7"]},{"vendor":"Red Hat","product":"Red Hat Mobile Application Platform 4","packageName":"keycloak","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:mobile_application_platform:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Application Runtimes","packageName":"keycloak","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_application_runtimes:1.0"]},{"vendor":"Red Hat","product":"Red Hat Process Automation 7","packageName":"keycloak","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"rh-sso7-keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]},{"vendor":"Red Hat","product":"Red Hat support for Spring Boot","packageName":"keycloak","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_application_runtimes:1.0"]}],"references":["https://access.redhat.com/security/cve/CVE-2023-6841","https://bugzilla.redhat.com/show_bug.cgi?id=2254714"],"weaknesses":["CWE-231"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/6xxx/CVE-2023-6841.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-6841","state":"PUBLISHED","datePublished":"2024-09-10T16:15:32.639Z","dateUpdated":"2025-11-08T07:10:39.283Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2023-12-15T12:33:39.292Z"},"containers":{"cna":{"title":"Keycloak: amount of attributes per object is not limited and it may lead to dos","descriptions":[{"lang":"en","value":"A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values."}],"affected":[{"packageName":"keycloak","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"24.0.0","versionType":"semver"}],"collectionURL":"https://github.com/keycloak/keycloak"},{"vendor":"Red Hat","product":"Red Hat build of Quarkus","packageName":"keycloak","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_application_runtimes:1.0"]},{"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"keycloak","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_fuse:7"]},{"vendor":"Red Hat","product":"Red Hat Mobile Application Platform 4","packageName":"keycloak","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:mobile_application_platform:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Application Runtimes","packageName":"keycloak","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_application_runtimes:1.0"]},{"vendor":"Red Hat","product":"Red Hat Process Automation 7","packageName":"keycloak","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"rh-sso7-keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]},{"vendor":"Red Hat","product":"Red Hat support for Spring Boot","packageName":"keycloak","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_application_runtimes:1.0"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-6841","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254714","name":"RHBZ#2254714","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-231","description":"Improper Handling of Extra Values","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2025-11-08T07:10:39.283Z"},"datePublic":"2024-09-10T15:45:00.000Z","x_redhatCweChain":"CWE-231: Improper Handling of Extra Values","workarounds":[{"lang":"en","value":"This CVE is mitigated by the 'User Profile' functionality, which was introduced in Keycloak 24. This feature introduces additional validation which prevents this vulnerability from being exploited."}],"timeline":[{"lang":"en","time":"2023-12-15T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2024-09-10T15:45:00.000Z","value":"Made public."}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-01T20:20:35.831984Z","id":"CVE-2023-6841","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-01T20:20:45.372Z"}}]}}}