Keycloak: offline session token dos
Published Dec 14, 2023
7.7
HIGHCVSS 3.1
EPSS 1.24%
Description
An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system.
Affected products
No data.
Configuration 2
- 7.6
Running on/with
- 7.0
- 8.0
- 9.0
Configuration 3
- n/a
Configuration 4
- 4.11
- 4.12
Running on/with
- 8.0
Configuration 5
- 4.9
- 4.10
Running on/with
- 8.0
Configuration 6
- 4.9
- 4.10
Running on/with
- 8.0
No data.
RHEL-8 based Middleware Containers
rh-sso-7/sso7-rhel8-operator-bundle:7.6.6-2
Fixed · RHSA-2023:7857
RHEL-8 based Middleware Containers
rh-sso-7/sso76-openshift-rhel8:7.6-38
Fixed · RHSA-2023:7857
Red Hat Single Sign-On 7.6 for RHEL 7
rh-sso7-keycloak-0:18.0.11-2.redhat_00003.1.el7sso
Fixed · RHSA-2023:7854
Red Hat Single Sign-On 7.6 for RHEL 8
rh-sso7-keycloak-0:18.0.11-2.redhat_00003.1.el8sso
Fixed · RHSA-2023:7856
Red Hat Single Sign-On 7.6 for RHEL 9
rh-sso7-keycloak-0:18.0.11-2.redhat_00003.1.el9sso
Fixed · RHSA-2023:7855
Single Sign-On 7.6.6
rh-sso7-keycloak
Fixed · RHSA-2023:7858
Red Hat Build of Keycloak
keycloak-core
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| RHEL-8 based Middleware Containers | rh-sso-7/sso7-rhel8-operator-bundle:7.6.6-2 | Fixed | RHSA-2023:7857 |
| RHEL-8 based Middleware Containers | rh-sso-7/sso76-openshift-rhel8:7.6-38 | Fixed | RHSA-2023:7857 |
| Red Hat Single Sign-On 7.6 for RHEL 7 | rh-sso7-keycloak-0:18.0.11-2.redhat_00003.1.el7sso | Fixed | RHSA-2023:7854 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | rh-sso7-keycloak-0:18.0.11-2.redhat_00003.1.el8sso | Fixed | RHSA-2023:7856 |
| Red Hat Single Sign-On 7.6 for RHEL 9 | rh-sso7-keycloak-0:18.0.11-2.redhat_00003.1.el9sso | Fixed | RHSA-2023:7855 |
| Single Sign-On 7.6.6 | rh-sso7-keycloak | Fixed | RHSA-2023:7858 |
| Red Hat Build of Keycloak | keycloak-core | Not affected | n/a |
No package ranges for this CVE.
Remediation
Vendor solution
There are three main options to prevent exploitation: 1) If you are using a reverse proxy, block the consents URL. 2) This option is less effective: remove the consents application tab from the account console theme. 3) This option has a significant negative impact on end users: entirely disable offline user profiles.
Red Hat statement
While this vulnerability can enable complete compromise of system availability, it is not possible to be triggered in every environment. The impact is rated as Important due to several preconditions (number of users and how many sessions each user has) which are beyond an attacker's control.
Red Hat mitigation
There are three main options to prevent exploitation: 1) If you are using a reverse proxy, block the consents URL. 2) This option is less effective: remove the consents application tab from the account console theme. 3) This option has a significant negative impact on end users: entirely disable offline user profiles.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2023–2026- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (8 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 1.24% (0.01239) | 68.04th | v5 (v2026.06.15) |
| Jun 15, 2026 | 1.24% (0.01239) | 65.14th | v5 (v2026.06.15) |
| Mar 30, 2025 | 1.18% (0.01178) | 76.81th | v4 (v2025.03.14) |
| Mar 29, 2025 | 3.54% (0.03538) | 79.21th | v4 (v2025.03.14) |
| Mar 17, 2025 | 1.33% (0.01328) | 78.59th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.11% (0.00111) | 46.03th | v3 (v2023.03.01) |
| Dec 28, 2023 | 0.09% (0.00092) | 38.80th | v3 (v2023.03.01) |
| Dec 15, 2023 | 0.04% (0.00044) | 10.64th | v3 (v2023.03.01) |
References (13)
- https://access.redhat.com/errata/RHSA-2023:7854 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2023:7855 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2023:7856 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/errata/RHSA-2023:7857 vendor-advisoryx_refsource_REDHATExploit
- https://access.redhat.com/errata/RHSA-2023:7858 vendor-advisoryx_refsource_REDHATVendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-6563 vdb-entryx_refsource_REDHATVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2253308 issue-trackingx_refsource_REDHATIssue Tracking
- https://github.com/advisories/GHSA-54f3-c6hg-865h Advisory
- https://github.com/keycloak/keycloak/commit/556146f961f7c8ddf64de15e2117a58d045f72b5
- https://github.com/keycloak/keycloak/issues/13340 Issue Tracking
- https://github.com/keycloak/keycloak/pull/15463
- https://nvd.nist.gov/vuln/detail/CVE-2023-6563
- https://www.cve.org/CVERecord?id=CVE-2023-6563
Change history (0)
No recorded changes yet.