{"id":"CVE-2021-3856","details":"ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.","aliases":["GHSA-3w4v-rvc4-2xpw"],"modified":"2026-08-07T16:57:32.531638Z","published":"2022-08-26T16:15:09.570Z","references":[{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2021-3856"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2010164"},{"type":"REPORT","url":"https://issues.redhat.com/browse/KEYCLOAK-19422"},{"type":"FIX","url":"https://github.com/keycloak/keycloak/commit/73f0474008e1bebd0733e62a22aceda9e5de6743"},{"type":"FIX","url":"https://github.com/keycloak/keycloak/pull/8588"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/keycloak/keycloak","events":[{"introduced":"0"},{"fixed":"843566019e09d15fa0e4778356463bc9a430e965"},{"fixed":"73f0474008e1bebd0733e62a22aceda9e5de6743"}],"database_specific":{"cpe":"cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"15.1.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["2.4.0.Test","1.3.0.Final","1.1.0.Beta2","1.0.0.Final","1.0-final","1.0-rc-1","1.0-beta-4","1.0-beta-2","1.0-beta-1","1.0-alpha-3","1.0-alpha-2","1.0-alpha-1","1.0-alpha-1-12062013"],"database_specific":{"vanir_signatures_modified":"2026-08-07T16:57:32Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/keycloak/keycloak/commit/73f0474008e1bebd0733e62a22aceda9e5de6743","target":{"file":"services/src/main/java/org/keycloak/theme/ClassLoaderTheme.java"},"deprecated":false,"digest":{"line_hashes":["124260399539281011717707373586744147021","273546477869425480957980733809903113856","285018114609585019930830636075742367167","133178131592467951898160846919801786489","96407110543803275689348891033921234091"],"threshold":0.9},"id":"CVE-2021-3856-1dad238c","signature_type":"Line"},{"source":"https://github.com/keycloak/keycloak/commit/73f0474008e1bebd0733e62a22aceda9e5de6743","target":{"file":"services/src/main/java/org/keycloak/theme/ClasspathThemeResourceProviderFactory.java"},"deprecated":false,"digest":{"line_hashes":["121861020690458924525486788093213951948","248515847350033744246149201106405994849","3330082002857581691640005490138153212","225176885544135933599938528445378366721"],"threshold":0.9},"id":"CVE-2021-3856-2ade5fb0","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2021-3856-3c06b61d","signature_type":"Function","signature_version":"v1","source":"https://github.com/keycloak/keycloak/commit/73f0474008e1bebd0733e62a22aceda9e5de6743","target":{"file":"services/src/main/java/org/keycloak/theme/ClasspathThemeResourceProviderFactory.java","function":"getResourceAsStream"},"deprecated":false,"digest":{"function_hash":"173054477908208581461759922352527267037","length":123}},{"id":"CVE-2021-3856-67fb8d24","signature_type":"Function","signature_version":"v1","source":"https://github.com/keycloak/keycloak/commit/73f0474008e1bebd0733e62a22aceda9e5de6743","target":{"file":"services/src/main/java/org/keycloak/theme/ClassLoaderTheme.java","function":"getResourceAsStream"},"deprecated":false,"digest":{"function_hash":"163715556613522604159357137207365211778","length":91}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3856.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}]}