CVE-2023-6841
HIGHRedhat Keycloak < 24.0.0 - Denial of Service
Title source: ruleDescription
A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.
Scores
CVSS v3
7.5
EPSS
0.0061
EPSS Percentile
69.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Classification
CWE
CWE-231
Status
published
Affected Products (3)
redhat/keycloak
redhat/single_sign-on
org.keycloak/keycloak-core
< 24.0.0Maven
Timeline
Published
Sep 10, 2024
Tracked Since
Feb 18, 2026