CVE-2014-3651: Keycloak vulnerable to uncontrolled resource consumption
Summary
CVE-2014-3651: Keycloak vulnerable to uncontrolled resource consumption. Affects org.keycloak:keycloak-core versions < 1.0.3. Fixed in 1.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that provides single sign-on capabilities for web applications. It is built on top of the JBoss application server and offers features such as user authentication, authorization, and user federation. The keycloak-core package is a core component of Keycloak that handles various authentication and authorization functionalities.
Vulnerability Detail
Keycloak versions prior to 1.0.3.Final are vulnerable to uncontrolled resource consumption. This vulnerability allows remote attackers to create a denial of service (DoS) attack by supplying a large value in the size parameter to the auth/qrcode endpoint, which is used for QR code generation. By exploiting this vulnerability, an attacker can consume excessive server resources, leading to degraded performance or even a complete system crash. The vulnerability is assigned CVE-2014-3651 and has a CVSS score of 7.5 (High severity).
How To Fix
Latest published version: 26.8.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by upgrading to a patched version of Keycloak.
Conclusion
Keycloak versions prior to 1.0.3.Final are vulnerable to uncontrolled resource consumption, which can be exploited by remote attackers to launch denial of service attacks. To mitigate this vulnerability, it is crucial to upgrade to Keycloak version 1.0.3.Final or later. No known workarounds exist for this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-core →
FAQ
This vulnerability allows remote attackers to launch a denial of service attack, potentially leading to service disruption or system crashes.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Keycloak installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any known vulnerabilities.
There are no known public exploits for this vulnerability at the time of writing. However, it is crucial to apply the fix as soon as possible to mitigate the risk of potential attacks.
Yes, this vulnerability can be exploited remotely by sending a specially crafted request to the vulnerable Keycloak server.
There is no evidence of active exploitation of this vulnerability at the time of writing. However, it is always recommended to apply security patches promptly to protect against potential attacks.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-core.
