CVE-2020-10758: Allocation of Resources Without Limits or Throttling in Keycloak
Summary
CVE-2020-10758: Allocation of Resources Without Limits or Throttling in Keycloak. Affects org.keycloak:keycloak-parent versions < 11.0.1. Fixed in 11.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that allows organizations to secure their applications and services. It provides features such as single sign-on, user authentication, and authorization. Keycloak is widely used in various industries to manage user identities and access controls.
Vulnerability Detail
A vulnerability was discovered in Keycloak before version 11.0.1. This vulnerability allows for a denial-of-service (DoS) attack by sending multiple requests simultaneously to the Keycloak server. The attack can be executed by sending twenty requests with a Content-Length header value that exceeds the actual byte count of the request body. This can lead to resource exhaustion and impact the availability of the Keycloak server.
How To Fix
Minimum fixed version
11.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Keycloak to mitigate the risk of a DoS attack.
Conclusion
The Keycloak DoS vulnerability (CVE-2020-10758) poses a risk to the availability of Keycloak servers. It is crucial to upgrade to Keycloak version 11.0.1 or later to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-parent →
FAQ
Keycloak is an open-source identity and access management solution used for securing applications and services.
A denial-of-service attack is an attempt to disrupt the availability of a network or service by overwhelming it with a flood of illegitimate requests or excessive resource consumption.
The Keycloak DoS vulnerability can be exploited by sending multiple requests to the Keycloak server with a Content-Length header value that exceeds the actual byte count of the request body.
The Keycloak DoS vulnerability can lead to resource exhaustion and impact the availability of the Keycloak server, potentially causing service disruptions for applications relying on Keycloak for authentication and authorization.
To fix the Keycloak DoS vulnerability, it is recommended to upgrade Keycloak to version 11.0.1 or later, as this version includes a fix for the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-parent.
