{"id":"CVE-2023-6841","title":"Keycloak: amount of attributes per object is not limited and it may lead to dos","summary":"A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with lon…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-231"],"vendor":"Red Hat","product":"keycloak","affected":["keycloak < 24.0.0","keycloak","keycloak","keycloak","keycloak","keycloak","rh-sso7-keycloak (all versions)","keycloak"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2024-10-01T20:20:35.831984Z"},"published":"2024-09-10","updated":"2026-11-05","sourceUpdated":"2026-11-05T11:37:36.087Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-6841","references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-6841"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254714","label":"RHBZ#2254714"}],"tags":["cve.org"],"epss":0.00736,"epssPercentile":0.54699,"ingestedAt":"2026-11-05T21:36:00.813Z","slug":"CVE-2023-6841","body":"## Overview\n\nA denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.\n\n## Affected\n\n- `keycloak < 24.0.0`\n- `keycloak`\n- `keycloak`\n- `keycloak`\n- `keycloak`\n- `keycloak`\n- `rh-sso7-keycloak (all versions)`\n- `keycloak`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nThis CVE is mitigated by the 'User Profile' functionality, which was introduced in Keycloak 24. This feature introduces additional validation which prevents this vulnerability from being exploited.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}