Keycloak vulnerable to uncontrolled resource consumption

2018-10-1816:50:20

Google

osv.dev

0.001 Low

EPSS

Percentile

51.1%

JSON

JBoss KeyCloak versions prior to 1.0.3.Final allow remote attackers to create a denial of service (resource consumption) by supplying a large value in the size parameter to auth/qrcode, related to QR code generation.

CPENameOperatorVersion
org.keycloak:keycloak-coreeq1.0-alpha-3
org.keycloak:keycloak-coreeq1.0-beta-1
org.keycloak:keycloak-coreeq1.0-rc-2
org.keycloak:keycloak-coreeq1.0-rc-1
org.keycloak:keycloak-coreeq1.0.2.Final
org.keycloak:keycloak-coreeq1.0-final
org.keycloak:keycloak-coreeq1.0-beta-4
org.keycloak:keycloak-coreeq1.0-alpha-1
org.keycloak:keycloak-coreeq1.0-beta-3
org.keycloak:keycloak-coreeq1.0-beta-2

Name	Operator	Version
org.keycloak:keycloak-core	eq	1.0-alpha-3
org.keycloak:keycloak-core	eq	1.0-beta-1
org.keycloak:keycloak-core	eq	1.0-rc-2
org.keycloak:keycloak-core	eq	1.0-rc-1
org.keycloak:keycloak-core	eq	1.0.2.Final
org.keycloak:keycloak-core	eq	1.0-final
org.keycloak:keycloak-core	eq	1.0-beta-4
org.keycloak:keycloak-core	eq	1.0-alpha-1
org.keycloak:keycloak-core	eq	1.0-beta-3
org.keycloak:keycloak-core	eq	1.0-beta-2