{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://github.com/keycloak/keycloak","packageName":"keycloak","product":"","source":"CNA: redhat","vendor":"","versions":[{"lessThan":"24.0.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak","product":"Red Hat build of Quarkus","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak","product":"Red Hat Fuse 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak","product":"Red Hat Mobile Application Platform 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak","product":"Red Hat OpenShift Application Runtimes","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak","product":"Red Hat Process Automation 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rh-sso7-keycloak","product":"Red Hat Single Sign-On 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak","product":"Red Hat support for Spring Boot","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2023-6841","cwes":["CWE-231"],"description":"A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.","epss":{"date":"2026-11-04","percentile":0.54575,"score":0.00736},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793878656087,"publishedAt":1725984932639,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2023-6841"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254714"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"This CVE is mitigated by the 'User Profile' functionality, which was introduced in Keycloak 24. This feature introduces additional validation which prevents this vulnerability from being exploited."}],"revision":"07e3051135a3697bdcc1fd35fe99f83c1a50f9432328c946db6c86ec2dcf3aae","sources":[{"modifiedAt":1793878656087,"name":"CNA: redhat","retrievedAt":1793880601745,"url":"https://www.cve.org/CVERecord?id=CVE-2023-6841"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793880608067,"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-6841"}],"ssvc":{"assessedAt":1727814035831,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Keycloak: amount of attributes per object is not limited and it may lead to dos","updatedAt":1793880608067}