CVE-2018-10912: Vulnerability in org.keycloak:keycloak-core
Summary
CVE-2018-10912: Moderate severity vulnerability that affects org.keycloak:keycloak-core. Affects org.keycloak:keycloak-core versions < 4.0.0. Fixed in 4.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.keycloak:keycloak-core is a Maven package that provides core functionality for Keycloak, an open-source identity and access management solution. It is responsible for handling user sessions and authentication in Keycloak clusters. This package is vulnerable to an infinite loop in session replacement, which can be exploited by a malicious authenticated user to achieve a Denial of Service (DoS) attack on the server.
Vulnerability Detail
The vulnerability in org.keycloak:keycloak-core arises from a mishandling of expired session replacement in a Keycloak cluster with multiple nodes. When a session replacement occurs, if it is not properly handled, it can lead to an infinite loop. This can be exploited by a malicious authenticated user to continuously trigger session replacements and cause the server to become unresponsive, resulting in a DoS attack. The severity of this vulnerability is moderate, with a CVSS score of 4.9.
How To Fix
Latest published version: 26.8.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of org.keycloak:keycloak-core.
Conclusion
The vulnerability in org.keycloak:keycloak-core allows a malicious authenticated user to trigger an infinite loop in session replacement, resulting in a DoS attack on the server. It is recommended to upgrade to version 4.0.0.final or later of the package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-core →
FAQ
The vulnerability allows a malicious authenticated user to trigger an infinite loop in session replacement, leading to a DoS attack on the server.
No, this vulnerability can only be exploited by a malicious authenticated user.
The severity of this vulnerability is moderate, with a CVSS score of 4.9.
There are no known instances of this vulnerability being exploited in the wild.
Yes, upgrading to version 4.0.0.final or later of org.keycloak:keycloak-core fixes this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-core.
