High · published December 14, 2023
An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system.
| Product | Versions | Fixed in |
|---|---|---|
| redhat/single_sign-on | all versions | — |
| redhat/keycloak | < 21.0.0 | 21.0.0 |
| redhat/single_sign-on | all versions | — |
| redhat/openshift_container_platform | all versions | — |
| redhat/openshift_container_platform | all versions | — |
| redhat/openshift_container_platform_for_power | all versions | — |
| redhat/openshift_container_platform_for_power | all versions | — |
| redhat/openshift_container_platform_for_ibm_linuxone | all versions | — |
| redhat/openshift_container_platform_for_ibm_linuxone | all versions | — |