Denial Of Service (DoS)

2023-12-1506:33:27

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

denial of service

keycloak

input validation

memory consumption

cpu consumption

system crash

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

39.4%

JSON

org.keycloak: keycloak-model-jpa is vulnerable to Denial of Service (DoS). The vulnerability is due to a lack of input validation when handling a large number of offline client sessions in loadUserSessionsWithClientSessions method. This could lead to excessive memory and CPU consumption which could potentially crash the entire system.