CVE-2024-10270
Fixed in a distro release EPSS 1%CVSS 6.5
A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.
Products: Red Hat build of Keycloak 24, Red Hat build of Keycloak 24.0.9, Red Hat build of Keycloak 26.0, Red Hat build of Keycloak 26.0.6, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign-On 7
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.keycloak:keycloak-services | 24.0.9 |
| Maven | org.keycloak:keycloak-services | 26.0.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | keycloak | 26.0.6-r0 |
| Chainguard | keycloak-bitnami-compat | 26.0.6-r0 |
| Chainguard | keycloak-bitnami-fips | 26.0.6-r0 |
| Chainguard | keycloak-compat | 26.0.6-r0 |
| Chainguard | keycloak-fips | 26.0.6-r0 |
| Chainguard | keycloak-fips-bitnami-compat | 26.0.6-r0 |
| Chainguard | keycloak-fips-policy-140-2 | 26.0.6-r0 |
| Chainguard | keycloak-fips-policy-140-3 | 26.0.6-r0 |
| Chainguard | keycloak-iamguarded-compat | 26.0.6-r0 |
| Chainguard | keycloak-iamguarded-fips | 26.0.6-r0 |
| Wolfi | keycloak | 26.0.6-r0 |
| Wolfi | keycloak-bitnami-compat | 26.0.6-r0 |
| Wolfi | keycloak-compat | 26.0.6-r0 |
| Wolfi | keycloak-iamguarded-compat | 26.0.6-r0 |