Vulnerabilities > CVE-2018-10912 - Infinite Loop vulnerability in Redhat Keycloak

047910
CVSS 4.9 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
HIGH
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
redhat
CWE-835
NVD
Published: 2018-07-23
Updated: 2024-11-21

Summary

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the server.

Vulnerable Configurations

Part Description Count
Application
Redhat
89

Common Weakness Enumeration (CWE)

Redhat

advisories
  • rhsa
    idRHSA-2018:2428
  • rhsa
    idRHSA-2019:0877

References