high7.5
CVE-2014-3651
Keycloak vulnerable to uncontrolled resource consumption
Impact
JBoss KeyCloak versions prior to 1.0.3.Final allow remote attackers to create a denial of service (resource consumption) by supplying a large value in the size parameter to auth/qrcode, related to QR code generation.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.keycloak:keycloak-core | < 1.0.3 | 1.0.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Keycloak | Keycloak | before 1.0.3 |