Vulnerability · Published Jul 9, 2021 · Assigned by redhat
CVE-2021-3637
High 7.5
In plain English
A high-severity resource allocation without limits in keycloak-model-infinispan. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.1%top 33.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly which could lead to a DoS attack.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.keycloak:keycloak-model-infinispan | 14.0.0 | GHSA-2vp8-jv5v-6qh6 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | keycloak-model-infinispan | keycloak 14.0.0 |
Weakness: CWE-770
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1979638 x_refsource_MISC