Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2024-10270

Org.keycloak:keycloak-services: keycloak denial of service

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

keycloak

Default version status: unaffected

  • 0 to < 24.0.9affected
  • 25.0.0 to < 26.0.6affected

Red Hat Red Hat build of Keycloak 24

Default version status: affected

  • 24.0.9-1 to < *unaffected

Red Hat Red Hat build of Keycloak 24

Default version status: affected

  • 24-18 to < *unaffected

Red Hat Red Hat build of Keycloak 24

Default version status: affected

  • 24-18 to < *unaffected

Red Hat Red Hat build of Keycloak 24.0.9

Default version status: unaffected

Red Hat Red Hat build of Keycloak 26.0

Default version status: affected

  • 26.0.6-2 to < *unaffected

Red Hat Red Hat build of Keycloak 26.0

Default version status: affected

  • 26.0-5 to < *unaffected

Red Hat Red Hat build of Keycloak 26.0

Default version status: affected

  • 26.0-6 to < *unaffected

Red Hat Red Hat build of Keycloak 26.0.6

Default version status: unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8

Default version status: unaffected

Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack

Default version status: unaffected

Red Hat Red Hat Single Sign-On 7

Default version status: unknown

References