CVE-2024-9666

Description

A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation. This issue can lead to costly DNS resolution operations, which an attacker could exploit to tie up IO threads and potentially cause a denial of service. The attacker must have access to send requests to a Keycloak instance that is configured to accept proxy headers, specifically when reverse proxies do not overwrite incoming headers, and Keycloak is configured to trust these headers.

Reserved 2024-10-08 | Published 2024-11-25 | Updated 2024-12-24 | Assigner redhat

Problem types

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Product status

Default status
unaffected

Any version before 24.0.9
affected

25.0.0 before 26.0.6
affected

Default status
affected

24.0.9-1 before *
unaffected

Default status
affected

24-18 before *
unaffected

Default status
affected

24-18 before *
unaffected

Default status
unaffected

Default status
affected

26.0.6-2 before *
unaffected

Default status
affected

26.0-5 before *
unaffected

Default status
affected

26.0-6 before *
unaffected

Default status
unaffected

Default status
unaffected

Timeline

2024-10-08:	Reported to Red Hat.
2024-11-21:	Made public.

References

access.redhat.com/errata/RHSA-2024:10175 (RHSA-2024:10175) vendor-advisory

access.redhat.com/errata/RHSA-2024:10176 (RHSA-2024:10176) vendor-advisory

access.redhat.com/errata/RHSA-2024:10177 (RHSA-2024:10177) vendor-advisory

access.redhat.com/errata/RHSA-2024:10178 (RHSA-2024:10178) vendor-advisory

access.redhat.com/security/cve/CVE-2024-9666 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2317440 (RHBZ#2317440) issue-tracking

cve.org (CVE-2024-9666)

nvd.nist.gov (CVE-2024-9666)

Download JSON