An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system.
2023-12-14T18:15:45.540
2024-11-21T08:44:06.483
Modified
CVSSv3.1: 7.7 (HIGH)
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | redhat | keycloak | < 21.0.0 | Yes |
| Application | redhat | single_sign-on | 7.6 | Yes |
| Operating System | redhat | enterprise_linux | 7.0 | No |
| Operating System | redhat | enterprise_linux | 8.0 | No |
| Operating System | redhat | enterprise_linux | 9.0 | No |
| Application | redhat | single_sign-on | - | Yes |
| Application | redhat | openshift_container_platform | 4.11 | Yes |
| Application | redhat | openshift_container_platform | 4.12 | Yes |
| Operating System | redhat | enterprise_linux | 8.0 | No |
| Application | redhat | openshift_container_platform_for_power | 4.9 | Yes |
| Application | redhat | openshift_container_platform_for_power | 4.10 | Yes |
| Operating System | redhat | enterprise_linux | 8.0 | No |
| Application | redhat | openshift_container_platform_for_ibm_linuxone | 4.9 | Yes |
| Application | redhat | openshift_container_platform_for_ibm_linuxone | 4.10 | Yes |
| Operating System | redhat | enterprise_linux | 8.0 | No |