Bug 2321214 (CVE-2024-10270) - CVE-2024-10270 org.keycloak:keycloak-services: Keycloak Denial of Service
Summary: CVE-2024-10270 org.keycloak:keycloak-services: Keycloak Denial of Service
Keywords:
Status: NEW
Alias: CVE-2024-10270
Deadline: 2024-11-21
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-10-23 01:55 UTC by OSIDB Bzimport
Modified: 2025-09-25 03:54 UTC (History)
38 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:10175 0 None None None 2024-11-21 19:23:30 UTC
Red Hat Product Errata RHSA-2024:10176 0 None None None 2024-11-21 19:23:55 UTC
Red Hat Product Errata RHSA-2024:10177 0 None None None 2024-11-21 19:24:33 UTC
Red Hat Product Errata RHSA-2024:10178 0 None None None 2024-11-21 19:24:51 UTC

Description OSIDB Bzimport 2024-10-23 01:55:08 UTC 
A vulnerability was found in Keycloak-services package. If untrusted data is passed to
the method (SearchQueryUtils), it could lead to a denial-of-service scenario by exhausting system resources.
Comment 1 errata-xmlrpc 2024-11-21 19:23:28 UTC 
This issue has been addressed in the following products:

  Red Hat build of Keycloak 24

Via RHSA-2024:10175 https://access.redhat.com/errata/RHSA-2024:10175
Comment 2 errata-xmlrpc 2024-11-21 19:23:53 UTC 
This issue has been addressed in the following products:

  Red Hat build of Keycloak 24.0.9

Via RHSA-2024:10176 https://access.redhat.com/errata/RHSA-2024:10176
Comment 3 errata-xmlrpc 2024-11-21 19:24:30 UTC 
This issue has been addressed in the following products:

  Red Hat build of Keycloak 26.0

Via RHSA-2024:10177 https://access.redhat.com/errata/RHSA-2024:10177
Comment 4 errata-xmlrpc 2024-11-21 19:24:48 UTC 
This issue has been addressed in the following products:

  Red Hat build of Keycloak 26.0.6

Via RHSA-2024:10178 https://access.redhat.com/errata/RHSA-2024:10178
Comment 5 kaylafannin042 2024-11-25 07:45:14 UTC 
(In reply to errata-xmlrpc from comment #3)
> This issue has been addressed in the following products:
> 
>   Red Hat build of Keycloak 26.0
> 
> Via RHSA-2024:10177 https://slope3.com https://access.redhat.com/errata/RHSA-2024:10177



Link ID: Red Hat Product Errata RHSA-2024:10177
Comment 6 Chess Hazlett 2024-11-27 20:21:39 UTC 
upstream commit: https://github.com/keycloak/keycloak/commit/5d6c91f3309db468b0fe4834e88c3d25649f73e4
Comment 7 evelynwang0308 2025-05-14 08:59:04 UTC 
(In reply to errata-xmlrpc from comment #4)
> This issue has been addressed in the following products:
> 
>   Red Hat build of Keycloak 26.0.6
> 
> Via RHSA-2024:10178 https://grade-calculator.io/ https://access.redhat.com/errata/RHSA-2024:10178

Link ID: Red Hat Product Errata RHSA-2024:10178
Comment 8 TomBrooks 2025-08-15 03:52:50 UTC 
(In reply to errata-xmlrpc from comment #5)
> This issue has been addressed in the following products:
> 
>   Red Hat build of Keycloak 26.0.6
> 
> Via RHSA-2024:10178 https://doodlejump24.io/ https://access.redhat.com/errata/RHSA-2024:10178

Link ID: Red Hat Product Errata RHSA-2024:10178

I really value all the work you've put into this. Thanks for giving us such useful information.
Comment 9 Anna Lime 2025-09-25 03:54:47 UTC 
This issue has been addressed in the following products:
> 
>   Red Hat build of Keycloak 26.0.6
> 
> Via RHSA-2024:10178 https://cargamesonline.io/ https://access.redhat.com/errata/RHSA-2024:10178
I sincerely appreciate all of your hard work on this. We appreciate you providing us with this helpful information.
Note You need to log in before you can comment on or make changes to this bug.