CVE-2024-10270

Description

A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.

Reserved 2024-10-23 | Published 2024-11-25 | Updated 2024-12-06 | Assigner redhat

Problem types

Inefficient Regular Expression Complexity

Product status

Default status
unaffected

Any version before 24.0.9
affected

25.0.0 before 26.0.6
affected

Default status
affected

24.0.9-1 before *
unaffected

Default status
affected

24-18 before *
unaffected

Default status
affected

24-18 before *
unaffected

Default status
unaffected

Default status
affected

26.0.6-2 before *
unaffected

Default status
affected

26.0-5 before *
unaffected

Default status
affected

26.0-6 before *
unaffected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Default status
unknown

Timeline

2024-10-23:	Reported to Red Hat.
2024-11-21:	Made public.

References

access.redhat.com/errata/RHSA-2024:10175 (RHSA-2024:10175) vendor-advisory

access.redhat.com/errata/RHSA-2024:10176 (RHSA-2024:10176) vendor-advisory

access.redhat.com/errata/RHSA-2024:10177 (RHSA-2024:10177) vendor-advisory

access.redhat.com/errata/RHSA-2024:10178 (RHSA-2024:10178) vendor-advisory

access.redhat.com/security/cve/CVE-2024-10270 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2321214 (RHBZ#2321214) issue-tracking

cve.org (CVE-2024-10270)

nvd.nist.gov (CVE-2024-10270)

Download JSON