Home

Description

A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.

PUBLISHED Reserved 2023-12-15 | Published 2024-09-10 | Updated 2025-11-08 | Assigner redhat




HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Problem types

Improper Handling of Extra Values

Product status

Default status
unaffected

Any version before 24.0.0
affected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Default status
affected

Default status
unaffected

Timeline

2023-12-15:Reported to Red Hat.
2024-09-10:Made public.

References

access.redhat.com/security/cve/CVE-2023-6841 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2254714 (RHBZ#2254714) issue-tracking

cve.org (CVE-2023-6841)

nvd.nist.gov (CVE-2023-6841)

Download JSON