CVE-2024-10270

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-10270

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10270.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-10270

Aliases

GHSA-wq8x-cg39-8mrr

Downstream

CGA (2)

ECHO (1)

ECHO-c80e-9875-82a0

Published

2024-11-25T07:37:04Z

Modified

2026-09-22T08:11:25Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Org.keycloak:keycloak-services: keycloak denial of service

Details

A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.

Database specific

{
    "cna_assigner":  "redhat",
    "cwe_ids":  [
        "CWE-1333"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10270.json"
}

References

Affected packages

Git / github.com/keycloak/keycloak

Affected ranges

Type

GIT

Repo

https://github.com/keycloak/keycloak

Events

Introduced

5279b7f4530afc3c05699a2d8bbcdd18f557b6a9

Fixed

fb2bd05840ea10b0411379a89efd470f066c8aa2

Fixed

5ded193f7713fc9993c381177b70b6cbac0e92a0

Fixed

5d6c91f3309db468b0fe4834e88c3d25649f73e4

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "24.0.9"
        },
        {
            "introduced":  "25.0.0"
        },
        {
            "fixed":  "26.0.6"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.0-alpha-1

1.0-alpha-1-12062013

1.0-alpha-2

1.0-alpha-3

1.0-beta-1

1.0-beta-2

1.0-beta-4

1.0-final

1.0-rc-1

1.0.0.Final

1.1.0.Beta2

1.3.0.Final

2.*

2.4.0.Test

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10270.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "8228218200219836362174112733580486357",
                "204592219506340838804395906794517749677",
                "182487650448008761546371333730155731362",
                "119038504456674311851588533191309092069",
                "236797062324270012684341629106717149551",
                "232274029000167183808916116134034250959"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2024-10270-0f38eed2",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/keycloak/keycloak/commit/5d6c91f3309db468b0fe4834e88c3d25649f73e4",
        "target":  {
            "file":  "services/src/test/java/org/keycloak/utils/SearchQueryUtilsTest.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "169743852479489588012394093988943530912",
            "length":  110
        },
        "id":  "CVE-2024-10270-436c74e5",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/keycloak/keycloak/commit/5d6c91f3309db468b0fe4834e88c3d25649f73e4",
        "target":  {
            "file":  "services/src/main/java/org/keycloak/utils/SearchQueryUtils.java",
            "function":  "unescape"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "179276353931020872670553594480451907282",
            "length":  457
        },
        "id":  "CVE-2024-10270-60b39bc5",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/keycloak/keycloak/commit/5d6c91f3309db468b0fe4834e88c3d25649f73e4",
        "target":  {
            "file":  "services/src/main/java/org/keycloak/utils/SearchQueryUtils.java",
            "function":  "getFields"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "332749973201395277055322781709350695664",
                "211167290917588171390578826305670511504",
                "277537591117917356489906417159512574682",
                "336611960729491992911245283593758781742",
                "122713575193388390108340116245189873669",
                "88519399162914262962222073821816924323",
                "223442238572987983497804736003027308748",
                "160024602509232293475550432066059741225",
                "301005383705882005035087780859659266589",
                "5453036769966635067640867989981855023",
                "241451809980493952726207624760843612728",
                "129564882730434959967915498950822955462",
                "18675333690315843086017976209239140069",
                "83762563318837703229256942733522040261",
                "230966284665842959660313202817249453202",
                "149536964096768919373195028385387247998",
                "298777473810500117063087282230449264361",
                "8356058522226122715150488987140461999",
                "118984191699860390821087228528813968919",
                "31868947511320113972004273040860313575",
                "112689926802652892510106516584880132763",
                "93511694336466657531118219878825345799",
                "246761033337431135974648465665390333255",
                "68252565274498682817613462200892397433",
                "97138399822563933164593046806669991342"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2024-10270-891106eb",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/keycloak/keycloak/commit/5d6c91f3309db468b0fe4834e88c3d25649f73e4",
        "target":  {
            "file":  "services/src/main/java/org/keycloak/utils/SearchQueryUtils.java"
        }
    }
]

vanir_signatures_modified

"2026-09-22T08:11:25Z"