REDHAT-BUG-2321214: Medium severity Red Hat Keycloak vulnerability
A vulnerability was found in Keycloak-services package. If untrusted data is passed to the method (SearchQueryUtils), it could lead to a denial-of-service scenario by exhausting system resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Validate and sanitize all inputs before passing them to SearchQueryUtils. Enforce limits on query length, complexity and allowed characters; reject or normalize untrusted data to prevent excessive resource consumption.
Keycloak (Keycloak‑services - SearchQueryUtils) validate_and_sanitize_search_input = true - Compensating control
Implement request rate limiting and input size/complexity restrictions at the application boundary (API gateway, WAF or reverse proxy) to limit resource consumption from search queries and block overly large or malformed requests.
- Operational
Monitor logs and resource usage (CPU, memory) for abnormal patterns related to search queries; alert on spikes and throttle or block offending clients while investigating potential exploitation attempts.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2321214?
The vulnerability REDHAT-BUG-2321214 is classified as a potential denial-of-service risk due to resource exhaustion.
How do I fix REDHAT-BUG-2321214?
To remediate the issue in REDHAT-BUG-2321214, update your Keycloak services package to the latest version provided by Red Hat.
What are the potential impacts of REDHAT-BUG-2321214?
The potential impact of REDHAT-BUG-2321214 includes system resource exhaustion, leading to denial of service.
Which versions of Keycloak are affected by REDHAT-BUG-2321214?
REDHAT-BUG-2321214 affects the Red Hat Build of Keycloak services package.
What is the nature of the vulnerability in REDHAT-BUG-2321214?
The nature of the vulnerability in REDHAT-BUG-2321214 involves the improper handling of untrusted data in the SearchQueryUtils method.