{"id":"CVE-2025-2559","summary":"Org.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloak","details":"A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens with an excessively long expiration time, for example, 24 or 48 hours, the cache can grow indefinitely, leading to an OutOfMemoryError. This issue could result in a denial of service condition, preventing legitimate users from accessing the system.","aliases":["GHSA-2935-2wfm-hhpv"],"modified":"2026-08-12T14:52:32.918071Z","published":"2025-03-25T08:20:57.666Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2559.json","cna_assigner":"redhat","cwe_ids":["CWE-770"]},"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://catalog.redhat.com/software/containers/"},{"type":"WEB","url":"https://github.com/keycloak/keycloak/"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:4335"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:4336"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2025-2559"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2559.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2559"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2353868"},{"type":"REPORT","url":"https://github.com/keycloak/keycloak/issues/38576"},{"type":"FIX","url":"https://github.com/keycloak/keycloak/commit/a10c8119d4452b866b90a9019b2cc159919276ca"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/keycloak/keycloak","events":[{"introduced":"1d4ce3d8e9dbc9af996f9248996c78e145902a35"},{"introduced":"90f25533be7a7fe2f97e9c0d2040343a8e3e8738"},{"fixed":"7dca54e8dc0dbe23995e260c989c9ef2e9023a94"},{"fixed":"8d6046175da89a45c583821859ddf8ae5dfb4fcd"},{"fixed":"a10c8119d4452b866b90a9019b2cc159919276ca"}],"database_specific":{"extracted_events":[{"introduced":"23.0.0"},{"fixed":"26.0.11"},{"introduced":"26.1.0"},{"fixed":"26.1.5"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-2559.json","vanir_signatures_modified":"2026-08-12T14:52:32Z","vanir_signatures":[{"source":"https://github.com/keycloak/keycloak/commit/a10c8119d4452b866b90a9019b2cc159919276ca","target":{"file":"services/src/main/java/org/keycloak/authentication/authenticators/client/JWTClientValidator.java"},"deprecated":false,"digest":{"line_hashes":["99495539601978461797104946757775683432","136582808265309047874801596351273693980","147406706728040871718454698547305497979","325688004905325422922942534192339862550","203646125252265590415965187965001576457","233930968314448263078517150632578458400","87559914693719928603240101130548980776","40269991946593085019937622258852402612","32369642146548667978820170705753519917","297089583331427314864894634166669645187","65539410305777762687259700028662703215","16042915975709791495202969784886719431","137575164655374216848161791086381743061"],"threshold":0.9},"id":"CVE-2025-2559-4ae39811","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"46172163112779803195028627278594652112","length":877},"id":"CVE-2025-2559-605ca17a","signature_type":"Function","signature_version":"v1","source":"https://github.com/keycloak/keycloak/commit/a10c8119d4452b866b90a9019b2cc159919276ca","target":{"file":"services/src/main/java/org/keycloak/authentication/authenticators/client/JWTClientValidator.java","function":"validateTokenReuse"},"deprecated":false},{"target":{"file":"services/src/main/java/org/keycloak/authentication/authenticators/client/JWTClientValidator.java","function":"validateToken"},"deprecated":false,"digest":{"function_hash":"43652828651718544592582632549301905351","length":736},"id":"CVE-2025-2559-818406a3","signature_type":"Function","signature_version":"v1","source":"https://github.com/keycloak/keycloak/commit/a10c8119d4452b866b90a9019b2cc159919276ca"},{"digest":{"line_hashes":["138873874259460242731517666077215121068","307061160018297316716860852342551339080","22563539369615669290211265648088465786"],"threshold":0.9},"id":"CVE-2025-2559-98df06d3","signature_type":"Line","signature_version":"v1","source":"https://github.com/keycloak/keycloak/commit/a10c8119d4452b866b90a9019b2cc159919276ca","target":{"file":"services/src/main/java/org/keycloak/protocol/oidc/OIDCAdvancedConfigWrapper.java"},"deprecated":false},{"id":"CVE-2025-2559-bba77e99","signature_type":"Line","signature_version":"v1","source":"https://github.com/keycloak/keycloak/commit/a10c8119d4452b866b90a9019b2cc159919276ca","target":{"file":"testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/ClientAuthSignedJWTTest.java"},"deprecated":false,"digest":{"line_hashes":["207871681582131381051325541528469796774","232110511063997108434055783295008042299","201215482816556552952895325645540469170","314822569098284525717335466561956758374","324592060811291321952184208692851932791"],"threshold":0.9}},{"target":{"file":"server-spi-private/src/main/java/org/keycloak/protocol/oidc/OIDCConfigAttributes.java"},"deprecated":false,"digest":{"line_hashes":["45562650431411920322004661027263630410","271191974698034486555864630435569802759","185524619692396922334927469650153455199","153765689921600403660252748523739034367"],"threshold":0.9},"id":"CVE-2025-2559-f0bdf346","signature_type":"Line","signature_version":"v1","source":"https://github.com/keycloak/keycloak/commit/a10c8119d4452b866b90a9019b2cc159919276ca"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"}]}