Описание
A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable.
Меры по смягчению последствий
To mitigate this vulnerability, configure Keycloak to reject client-initiated TLS renegotiation by adding the following Java system property to the Keycloak startup configuration: -Djdk.tls.rejectClientInitiatedRenegotiation=true This prevents unauthenticated attackers from triggering repeated TLS renegotiations and exhausting server CPU resources. Additionally, ensure that Keycloak is deployed behind proper network access controls and rate-limiting mechanisms to further reduce exposure to DoS attacks.
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable.
A flaw was found in Keycloak. This vulnerability allows an unauthentic ...
Keycloak TLS Client-Initiated Renegotiation Denial of Service
7.5 High
CVSS3