An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system.
History

Wed, 18 Sep 2024 08:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:build_keycloak:22 cpe:/a:redhat:build_keycloak:

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2023-12-14T18:01:26.005Z

Updated: 2024-11-23T03:38:39.154Z

Reserved: 2023-12-06T18:47:35.594Z

Link: CVE-2023-6563

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2023-12-14T18:15:45.540

Modified: 2024-11-21T08:44:06.483

Link: CVE-2023-6563

cve-icon Redhat

Severity : Important

Publid Date: 2023-12-14T00:00:00Z

Links: CVE-2023-6563 - Bugzilla