Duplicate Advisory: Keylime's registrar vulnerable to Denial-of-service attack via a single open connection
Summary
GHSA-9gjg-834p-5gvv: Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pg75-v6fp-8q59. Affects keylime versions < 7.4.0. Fixed in 7.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keylime is an open-source package available on PyPI. It is designed to provide a secure and trusted bootstrapping process for cloud and edge devices. Keylime's registrar component is responsible for managing SSL connections. However, due to a flaw in its implementation, the registrar is susceptible to a remote denial-of-service attack. This vulnerability allows an attacker to exhaust all available connections, leading to a disruption in the SSL communication.
Vulnerability Detail
The vulnerability in Keylime's registrar arises from its blocking nature, which can be exploited by an attacker to launch a denial-of-service attack. By establishing a single open connection, the attacker can exhaust all available connections, rendering the registrar unable to handle legitimate requests. This can result in a complete disruption of SSL communication, impacting the secure bootstrapping process of cloud and edge devices. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 7.14.3 as of 22 Oct 2026
pip install --upgrade "keylime==7.14.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.4.0
This is the first release that contains the fix.
pip install --upgrade "keylime==7.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the Keylime package's registrar component is vulnerable to a denial-of-service attack that can be triggered by a single open connection. This vulnerability can disrupt the SSL communication during the bootstrapping process of cloud and edge devices. It is recommended to update the Keylime package to version 7.4.0 or above to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keylime →
FAQ
Keylime is an open-source package that provides a secure bootstrapping process for cloud and edge devices. It ensures the integrity and trustworthiness of the devices during the bootstrapping phase.
The registrar component in Keylime is responsible for managing SSL connections and facilitating the secure communication between devices during the bootstrapping process.
The vulnerability in the registrar allows an attacker to launch a denial-of-service attack by exhausting all available connections. This disrupts the SSL communication, impacting the secure bootstrapping process of cloud and edge devices.
The vulnerability has a CVSS score of 7.5, indicating a high severity level.
To fix this vulnerability, update the Keylime package to version 7.4.0 or above using the command 'pip install --upgrade keylime'.
Related vulnerabilities
Recent vulnerabilities recorded for keylime.
