CVE-2023-6841High· 7.5▾ TwilightA denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with lon…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.7%
A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.
keycloak < 24.0.0keycloakkeycloakkeycloakkeycloakkeycloakrh-sso7-keycloak (all versions)keycloakRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
This CVE is mitigated by the 'User Profile' functionality, which was introduced in Keycloak 24. This feature introduces additional validation which prevents this vulnerability from being exploited.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-6291High· 7.1A flaw was found in the redirect_uri validation logic in Keycloak
CVE-2023-6563High· 7.7An unconstrained memory consumption vulnerability was discovered in Keycloak
CVE-2023-6927Medium· 4.6A flaw was found in Keycloak
CVE-2025-3501High· 8.2A flaw was found in Keycloak
CVE-2025-2559Medium· 4.9A flaw was found in Keycloak
CVE-2024-1249High· 7.4A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages