CVE-2023-6841: Keycloak: amount of attributes per object is not limited and it may lead to dos
A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited, an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values. The issue is fixed in Keycloak 24 with the introduction of the User Profile feature.
Other sources
A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.
— NVD
Amount of attributes per object (users, groups, roles)) are not limited and the impact is
The application can not accept too large amount of attributes The application is struggling to serve the content of the attribute later for one item The application fails to serve a list of items when attribute values are included in the list It is possible to cause a denial of service when hammering the list endpoint that serves many rows with long attribute values
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6841?
CVE-2023-6841 is classified as a denial of service vulnerability that can lead to resource exhaustion.
How do I fix CVE-2023-6841?
To resolve CVE-2023-6841, you should upgrade to Keycloak version 24.0.0 or later.
What systems are affected by CVE-2023-6841?
CVE-2023-6841 affects Keycloak version prior to 24.0.0 and Red Hat Single Sign-On version 7.0.
What actions can an attacker take with CVE-2023-6841?
An attacker can exploit CVE-2023-6841 by sending repeated HTTP requests, potentially causing a denial of service.
Is there a workaround for CVE-2023-6841?
Currently, there are no known effective workarounds for CVE-2023-6841, so upgrading is recommended.