CVE-2023-6841
published 2024-09-10CVE-2023-6841: A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests…
PriorityP337high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.74%
50.1th percentile
A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | single_sign-on | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Keycloak Denial of Service vulnerability
ghsa·2024-09-10
CVE-2023-6841 [HIGH] CWE-231 Keycloak Denial of Service vulnerability
Keycloak Denial of Service vulnerability
A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited, an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values. The issue is fixed in Keycloak 24 with the introduction of the User Profile feature.
OSV
Keycloak Denial of Service vulnerability
osv·2024-09-10
CVE-2023-6841 [HIGH] Keycloak Denial of Service vulnerability
Keycloak Denial of Service vulnerability
A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited, an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values. The issue is fixed in Keycloak 24 with the introduction of the User Profile feature.
Red Hat
keycloak: Amount of attributes per object is not limited and it may lead to DOS
vendor_redhat·2024-09-10·CVSS 7.5
CVE-2023-6841 [HIGH] CWE-231 keycloak: Amount of attributes per object is not limited and it may lead to DOS
keycloak: Amount of attributes per object is not limited and it may lead to DOS
A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.
A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.
Statement: Red Hat has evaluated this vulnerability and it only affects the Red Hat Single Sign-On (RHSSO).
Mitigation: This CVE is mitigated by the 'User Profile' functionality, which was introduced in
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-09-10
Published