Skip to main content

Inefficient Regular Expression Complexity

CVE-2024-10270

High
7.1/10

Summary

A vulnerability exists in the Keycloak-services package, where passing untrusted data to the "SearchQueryUtils" method could lead to a Denial of Service (DoS) by exhausting system resources due to regular expression complexity. The vulnerability affects org.keycloak:keycloak-services package versions 14.0.0 prior to 24.0.9 and 25.0.0 prior to 26.0.6.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • NONE
  • HIGH

CWE-1333 - Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References

Advisory Timeline

  • Published