Description
It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | keycloak | 2.5.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-core | < 2.5.5 | 2.5.5 | GHSA-jc6q-27mw-p55w |