PT-2024-39748 · Red Hat+1 · Keycloak Server+2
Published
2024-10-08
·
Updated
2025-11-01
·
CVE-2024-9666
CVSS v3.1
4.7
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Keycloak Server (affected versions not specified)
Description
A denial of service (DoS) attack is possible due to improper handling of proxy headers in the Keycloak Server. When configured to accept incoming proxy headers, Keycloak may accept non-IP values without proper validation, leading to costly DNS resolution operations. An attacker could exploit this to tie up IO threads and cause a denial of service. The attacker must have access to send requests to a Keycloak instance configured to accept and trust proxy headers, particularly when reverse proxies do not overwrite incoming headers.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Keycloak
Keycloak Server