CVE-2023-6563
High
Description
An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system.
SeverityHigh
CVSS7.7
Exploit probability—
Product
Redhat Keycloak
PublishedDec 14, 2023
First seenDec 14, 2023
Weakness typeCWE-770Allocation of resources without limits
How to fix
Update
- redhat keycloak21.0.0 or later
- org.keycloak:keycloak-model-jpa21.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat keycloak | v < 21.0.0 | 21.0.0 |
| redhat single_sign-on | 7.6, No range specified | — |
| redhat openshift_container_platform | 4.11, 4.12 | — |
| redhat openshift_container_platform_for_power | 4.9, 4.10 | — |
| redhat openshift_container_platform_for_ibm_linuxone | 4.9, 4.10 | — |
| org.keycloak:keycloak-model-jpaMaven | v < 21.0.0 | 21.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.