CVE-2020-10758

HIGH

Keycloak < 11.0.1 - Denial of Service via Malformed Content-Length Header

Title source: llm
STIX 2.1

Description

A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, all with a Content-Length header value that exceeds the actual byte count of the request body.

References (2)

Core 2
Core References
Issue Tracking, Mitigation, Vendor Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1843849

Scores

CVSS v3 7.5
EPSS 0.0053
EPSS Percentile 67.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-770
Status published
Products (7)
org.keycloak/keycloak-parent 0 - 11.0.1Maven
redhat/keycloak < 11.0.1
redhat/openshift_application_runtimes
redhat/openshift_application_runtimes 1.0
redhat/single_sign-on
redhat/single_sign-on 7.0
redhat/single_sign-on 7.4
Published Sep 16, 2020
Tracked Since Feb 18, 2026