{"id":"CVE-2024-10270","summary":"Org.keycloak:keycloak-services: keycloak denial of service","details":"A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.","aliases":["GHSA-wq8x-cg39-8mrr"],"modified":"2026-08-12T15:16:56.727543Z","published":"2024-11-25T07:37:04.542Z","related":["CGA-65pr-w3vj-m8x3"],"database_specific":{"cna_assigner":"redhat","cwe_ids":["CWE-1333"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10270.json"},"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html"},{"type":"WEB","url":"https://catalog.redhat.com/software/containers/"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:10175"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:10176"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:10177"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:10178"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2024-10270"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10270.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wq8x-cg39-8mrr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10270"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2321214"},{"type":"FIX","url":"https://github.com/keycloak/keycloak/commit/5d6c91f3309db468b0fe4834e88c3d25649f73e4"},{"type":"PACKAGE","url":"https://github.com/keycloak/keycloak"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/keycloak/keycloak","events":[{"introduced":"0"},{"introduced":"5279b7f4530afc3c05699a2d8bbcdd18f557b6a9"},{"fixed":"fb2bd05840ea10b0411379a89efd470f066c8aa2"},{"fixed":"5ded193f7713fc9993c381177b70b6cbac0e92a0"},{"fixed":"5d6c91f3309db468b0fe4834e88c3d25649f73e4"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"24.0.9"},{"introduced":"25.0.0"},{"fixed":"26.0.6"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["2.4.0.Test","1.3.0.Final","1.1.0.Beta2","1.0.0.Final","1.0-final","1.0-rc-1","1.0-beta-4","1.0-beta-2","1.0-beta-1","1.0-alpha-3","1.0-alpha-2","1.0-alpha-1","1.0-alpha-1-12062013"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10270.json","vanir_signatures_modified":"2026-08-12T15:16:56Z","vanir_signatures":[{"digest":{"line_hashes":["8228218200219836362174112733580486357","204592219506340838804395906794517749677","182487650448008761546371333730155731362","119038504456674311851588533191309092069","236797062324270012684341629106717149551","232274029000167183808916116134034250959"],"threshold":0.9},"id":"CVE-2024-10270-0f38eed2","signature_type":"Line","signature_version":"v1","source":"https://github.com/keycloak/keycloak/commit/5d6c91f3309db468b0fe4834e88c3d25649f73e4","target":{"file":"services/src/test/java/org/keycloak/utils/SearchQueryUtilsTest.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/keycloak/keycloak/commit/5d6c91f3309db468b0fe4834e88c3d25649f73e4","target":{"file":"services/src/main/java/org/keycloak/utils/SearchQueryUtils.java","function":"unescape"},"deprecated":false,"digest":{"function_hash":"169743852479489588012394093988943530912","length":110},"id":"CVE-2024-10270-436c74e5"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/keycloak/keycloak/commit/5d6c91f3309db468b0fe4834e88c3d25649f73e4","target":{"file":"services/src/main/java/org/keycloak/utils/SearchQueryUtils.java","function":"getFields"},"deprecated":false,"digest":{"function_hash":"179276353931020872670553594480451907282","length":457},"id":"CVE-2024-10270-60b39bc5"},{"target":{"file":"services/src/main/java/org/keycloak/utils/SearchQueryUtils.java"},"deprecated":false,"digest":{"line_hashes":["332749973201395277055322781709350695664","211167290917588171390578826305670511504","277537591117917356489906417159512574682","336611960729491992911245283593758781742","122713575193388390108340116245189873669","88519399162914262962222073821816924323","223442238572987983497804736003027308748","160024602509232293475550432066059741225","301005383705882005035087780859659266589","5453036769966635067640867989981855023","241451809980493952726207624760843612728","129564882730434959967915498950822955462","18675333690315843086017976209239140069","83762563318837703229256942733522040261","230966284665842959660313202817249453202","149536964096768919373195028385387247998","298777473810500117063087282230449264361","8356058522226122715150488987140461999","118984191699860390821087228528813968919","31868947511320113972004273040860313575","112689926802652892510106516584880132763","93511694336466657531118219878825345799","246761033337431135974648465665390333255","68252565274498682817613462200892397433","97138399822563933164593046806669991342"],"threshold":0.9},"id":"CVE-2024-10270-891106eb","signature_type":"Line","signature_version":"v1","source":"https://github.com/keycloak/keycloak/commit/5d6c91f3309db468b0fe4834e88c3d25649f73e4"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}