7.5
High
CVE-2023-6841 Keycloak: amount of attributes per object is not limited and it may lead to dos
Description
A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat build of Quarkus | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat Mobile Application Platform 4 | Versions not published | |
| Red Hat OpenShift Application Runtimes | Versions not published | |
| Red Hat Process Automation 7 | Versions not published | |
| Red Hat Single Sign-On 7 | Versions not published | |
| Red Hat support for Spring Boot | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2254714 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat build of Quarkus
The 71 CVEs of Red Hat build of Quarkus →
CVE-2026-121837
Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored for filter and sort
4.3
Medium
CVE-2026-107912
Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw
7.7
High
CVE-2026-120971
A flaw was found in RESTEasy's default exception mapper
5.3
Medium
CVE-2026-87744
A flaw was found in Quarkus REST Data Panache
9.1
Critical