CVE-2021-3637: keycloak-model-infinispan - Allocation of Resources Without Limits or Throttling
Summary
CVE-2021-3637: Allocation of resources without limits or throttling in keycloak-model-infinispan. Affects org.keycloak:keycloak-model-infinispan versions < 14.0.0. Fixed in 14.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The keycloak-model-infinispan package is a component of Keycloak, an open-source identity and access management solution. It provides a model implementation using Infinispan as the underlying data store. Keycloak is widely used for securing web applications and services by providing authentication, authorization, and user management capabilities. The keycloak-model-infinispan package is responsible for managing authentication sessions in Keycloak.
Vulnerability Detail
A flaw has been discovered in keycloak-model-infinispan versions prior to 14.0.0. The vulnerability arises from the unbounded growth of the authenticationSessions map in the RootAuthenticationSessionEntity. This unrestricted growth can be exploited to launch a Denial of Service (DoS) attack. An attacker can continuously create new authentication sessions, causing the map to consume excessive memory resources and eventually leading to the exhaustion of system resources. This can result in service disruption and unavailability of the Keycloak instance.
How To Fix
Latest published version: 26.8.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
14.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement custom limits or throttling mechanisms in their Keycloak deployment to restrict the growth of the authenticationSessions map. This can be achieved by monitoring the size of the map and implementing logic to reject new authentication sessions when a certain threshold is reached. However, it is strongly advised to apply the official fix by upgrading to the latest version of the keycloak-model-infinispan package as soon as possible.
Conclusion
The vulnerability in the keycloak-model-infinispan package allows for the unbounded growth of the authenticationSessions map, leading to a potential Denial of Service (DoS) attack. To mitigate this vulnerability, it is recommended to upgrade to version 14.0.0 or later. Alternatively, users can implement custom limits or throttling mechanisms as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-model-infinispan →
FAQ
The vulnerability allows an attacker to launch a Denial of Service (DoS) attack by consuming excessive memory resources. This can lead to service disruption and unavailability of the Keycloak instance.
No, this vulnerability does not compromise the authentication process itself. It only affects the resource consumption of the Keycloak instance, potentially leading to a DoS attack.
No, only versions prior to 14.0.0 are affected. The vulnerability has been fixed in version 14.0.0 and later.
Yes, the vulnerability can be exploited remotely by an attacker who can send malicious requests to the Keycloak instance, triggering the unbounded growth of the authenticationSessions map.
There are no known instances of this vulnerability being exploited in the wild. However, it is important to apply the fix to prevent potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-model-infinispan.
