Denial of Service Vulnerability in Keycloak by Red Hat
CVE-2024-11734
6.5MEDIUM
Key Information:
- Vendor
- Red Hat
- Status
- Vendor
- CVE Published:
- 14 January 2025
Summary
A vulnerability exists in Keycloak that can be exploited by an administrative user possessing the authority to alter realm settings. By modifying security headers and introducing newline characters, the Keycloak server may attempt to process a request that has already been terminated. This can lead to a denial of service, effectively disrupting the service for users. It is crucial for administrators to be aware of this vulnerability and to apply the necessary mitigations promptly.
Affected Version(s)
Red Hat build of Keycloak 26.0 26.0.8-1
Red Hat build of Keycloak 26.0 26.0-7
Red Hat build of Keycloak 26.0 26.0-8
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank Chase Bowman (Contract Security) for reporting this issue.