Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2025-2559

Опубликовано: 20 мар. 2025
Источник: redhat
CVSS3: 4.9

Описание

A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens with an excessively long expiration time, for example, 24 or 48 hours, the cache can grow indefinitely, leading to an OutOfMemoryError. This issue could result in a denial of service condition, preventing legitimate users from accessing the system.

Отчет

Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-770: Allocation of Resources Without Limits or Throttling vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low. The platform enforces hardening guidelines to apply the most restrictive settings required for operations, while baseline configurations maintain secure system and software states. A defense-in-depth monitoring strategy includes perimeter firewalls and endpoint protection services that detect excessive resource usage caused by malicious activity or system misconfigurations. In the event of exploitation, process isolation ensures workloads operate in separate environments, preventing any single process from overconsuming CPU or memory and degrading system performance.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Single Sign-On 7keycloak-servicesFix deferred
Red Hat Build of Keycloakkeycloak-servicesFixedRHSA-2025:433629.04.2025
Red Hat build of Keycloak 26.0rhbk/keycloak-operator-bundleFixedRHSA-2025:433529.04.2025
Red Hat build of Keycloak 26.0rhbk/keycloak-rhel9FixedRHSA-2025:433529.04.2025
Red Hat build of Keycloak 26.0rhbk/keycloak-rhel9-operatorFixedRHSA-2025:433529.04.2025

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-770
https://bugzilla.redhat.com/show_bug.cgi?id=2353868org.keycloak/keycloak-services: JWT Token Cache Exhaustion Leading to Denial of Service (DoS) in Keycloak

4.9 Medium

CVSS3

Связанные уязвимости

CVSS3: 4.9
nvd
5 месяцев назад

A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens with an excessively long expiration time, for example, 24 or 48 hours, the cache can grow indefinitely, leading to an OutOfMemoryError. This issue could result in a denial of service condition, preventing legitimate users from accessing the system.

CVSS3: 4.9
debian
5 месяцев назад

A flaw was found in Keycloak. When the configuration uses JWT tokens f ...

CVSS3: 4.9
github
5 месяцев назад

Keycloak Denial of Service (DoS) Vulnerability via JWT Token Cache

4.9 Medium

CVSS3