{"id":"CVE-2024-10270","revision":"1b7294dfed60453dacb87e90578639fe","records":[{"revision":"1b7294dfed60453dacb87e90578639fe","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-10270","aliases":[],"title":"Org.keycloak:keycloak-services: keycloak denial of service","description":"A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.","state":0,"publishedAt":"2024-11-25T07:37:04.542+00:00","modifiedAt":"2026-10-13T18:44:43.584+00:00","affected":[{"ecosystem":"https://github.com/keycloak/keycloak","name":"keycloak","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"24.0.9\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"25.0.0\",\n                            \"lessThan\": \"26.0.6\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"packageName\": \"keycloak\",\n                    \"collectionURL\": \"https://github.com/keycloak/keycloak\",\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhbk/keycloak-operator-bundle","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 24\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhbk/keycloak-operator-bundle\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"24.0.9-1\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:24::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhbk/keycloak-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 24\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhbk/keycloak-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"24-18\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:24::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhbk/keycloak-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 24\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhbk/keycloak-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"24-18\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:24::el9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"Red Hat build of Keycloak 24.0.9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 24.0.9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:24\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhbk/keycloak-operator-bundle","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 26.0\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhbk/keycloak-operator-bundle\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"26.0.6-2\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:26.0::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhbk/keycloak-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 26.0\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhbk/keycloak-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"26.0-5\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:26.0::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhbk/keycloak-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 26.0\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhbk/keycloak-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"26.0-6\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:26.0::el9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"Red Hat build of Keycloak 26.0.6","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 26.0.6\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:26.0\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","name":"keycloak-services","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat JBoss Enterprise Application Platform 8\",\n                    \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\",\n                    \"packageName\": \"keycloak-services\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:jboss_enterprise_application_platform:8\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","name":"keycloak-services","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\n                    \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\",\n                    \"packageName\": \"keycloak-services\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:jbosseapxp\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"keycloak-services","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Single Sign-On 7\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"keycloak-services\",\n                    \"defaultStatus\": \"unknown\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:red_hat_single_sign_on:7\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5,"severity":"MEDIUM"}],"references":["https://access.redhat.com/errata/RHSA-2024:10175","https://access.redhat.com/errata/RHSA-2024:10176","https://access.redhat.com/errata/RHSA-2024:10177","https://access.redhat.com/errata/RHSA-2024:10178","https://access.redhat.com/security/cve/CVE-2024-10270","https://bugzilla.redhat.com/show_bug.cgi?id=2321214","https://github.com/advisories/GHSA-wq8x-cg39-8mrr","https://github.com/keycloak/keycloak/commit/5d6c91f3309db468b0fe4834e88c3d25649f73e4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-10270","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-10270","identifiers":["CVE-2024-10270"]},"retained":false,"historicalAffected":[]}],"coverage":[]}