CVE-2018-10912 — keycloak: infinite loop in session replacement leading to denial of service

Back Back to CVE browser

MEDIUM

keycloak: infinite loop in session replacement leading to denial of service

Published Jul 23, 2018

4.9

MEDIUM

CVSS 3.1

EPSS 1.31%

Description

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the server.

Affected products

Vendor n/a Product Keycloak Default
n/a
- Version
  Keycloak 4.0.0.Final
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Keycloak

n/a

Version	Status	Constraints
Keycloak 4.0.0.Final	affected	-

Red Hat Single Sign-On 7.2.4 zip

n/a

Fixed · RHSA-2018:2428
Text-Only RHOAR

n/a

Fixed · RHSA-2019:0877
Red Hat Fuse 7

keycloak

Not affected
Red Hat Mobile Application Platform 4

keycloak

Not affected
Red Hat OpenShift Application Runtimes

keycloak

Affected
Red Hat Single Sign-On 7

rh-sso7-keycloak

Affected

Product	Package	State	Advisory
Red Hat Single Sign-On 7.2.4 zip	n/a	Fixed	RHSA-2018:2428
Text-Only RHOAR	n/a	Fixed	RHSA-2019:0877
Red Hat Fuse 7	keycloak	Not affected	n/a
Red Hat Mobile Application Platform 4	keycloak	Not affected	n/a
Red Hat OpenShift Application Runtimes	keycloak	Affected	n/a
Red Hat Single Sign-On 7	rh-sso7-keycloak	Affected	n/a

Remediation

No remediation recorded yet.

Metrics

1.31% 0.01310

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.01310

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	1.31% (0.01310)	69.62th	v5 (v2026.06.15)
Sep 20, 2026	1.31% (0.01310)	69.36th	v5 (v2026.06.15)
Jul 20, 2024	0.09% (0.00088)	38.17th	v3 (v2023.03.01)
May 7, 2024	0.09% (0.00088)	37.20th	v3 (v2023.03.01)
Sep 3, 2023	0.12% (0.00123)	45.99th	v3 (v2023.03.01)
Mar 7, 2023	0.10% (0.00102)	40.19th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00890)	30.33th	v2 (v2022.01.01)
Feb 4, 2022	0.89% (0.00890)	12.04th	v2 (v2022.01.01)
Feb 3, 2022	1.04% (0.01036)	27.56th	v5 (v2026.06.15)
Apr 14, 2021	1.04% (0.01036)	0.00th	v1

Weaknesses (1)

CWE-835

References (8)

https://access.redhat.com/errata/RHSA-2018:2428
vendor-advisoryx_refsource_REDHATVendor Advisory
https://access.redhat.com/errata/RHSA-2019:0877
vendor-advisoryx_refsource_REDHATVendor Advisory
https://access.redhat.com/security/cve/CVE-2018-10912
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1607624
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10912
x_refsource_CONFIRMIssue TrackingVendor Advisory
https://github.com/advisories/GHSA-h7j7-pw3v-3v3x
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-10912
https://www.cve.org/CVERecord?id=CVE-2018-10912

Link	Providers	Tags
https://access.redhat.com/errata/RHSA-2018:2428		vendor-advisoryx_refsource_REDHATVendor Advisory
https://access.redhat.com/errata/RHSA-2019:0877		vendor-advisoryx_refsource_REDHATVendor Advisory
https://access.redhat.com/security/cve/CVE-2018-10912		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1607624		Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10912		x_refsource_CONFIRMIssue TrackingVendor Advisory
https://github.com/advisories/GHSA-h7j7-pw3v-3v3x		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-10912
https://www.cve.org/CVERecord?id=CVE-2018-10912