CVE-2024-10270

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-10270
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10270.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-10270
Aliases
Related
Published
2024-11-25T07:37:04.542Z
Modified
2026-08-12T15:16:56.727543Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Org.keycloak:keycloak-services: keycloak denial of service
Details

A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.

Database specific 
{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-1333"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10270.json"
}
References

Affected packages

Git / github.com/keycloak/keycloak

Affected ranges

Type
GIT
Repo
https://github.com/keycloak/keycloak
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
5279b7f4530afc3c05699a2d8bbcdd18f557b6a9
Fixed
fb2bd05840ea10b0411379a89efd470f066c8aa2
Fixed
5ded193f7713fc9993c381177b70b6cbac0e92a0
Fixed
5d6c91f3309db468b0fe4834e88c3d25649f73e4
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "24.0.9"
        },
        {
            "introduced": "25.0.0"
        },
        {
            "fixed": "26.0.6"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.0-alpha-1
1.0-alpha-1-12062013
1.0-alpha-2
1.0-alpha-3
1.0-beta-1
1.0-beta-2
1.0-beta-4
1.0-final
1.0-rc-1
1.0.0.Final
1.1.0.Beta2
1.3.0.Final
2.*
2.4.0.Test

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10270.json"
vanir_signatures 
[
    {
        "target": {
            "file": "services/src/test/java/org/keycloak/utils/SearchQueryUtilsTest.java"
        },
        "deprecated": false,
        "source": "https://github.com/keycloak/keycloak/commit/5d6c91f3309db468b0fe4834e88c3d25649f73e4",
        "id": "CVE-2024-10270-0f38eed2",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "8228218200219836362174112733580486357",
                "204592219506340838804395906794517749677",
                "182487650448008761546371333730155731362",
                "119038504456674311851588533191309092069",
                "236797062324270012684341629106717149551",
                "232274029000167183808916116134034250959"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "unescape",
            "file": "services/src/main/java/org/keycloak/utils/SearchQueryUtils.java"
        },
        "deprecated": false,
        "source": "https://github.com/keycloak/keycloak/commit/5d6c91f3309db468b0fe4834e88c3d25649f73e4",
        "id": "CVE-2024-10270-436c74e5",
        "signature_version": "v1",
        "digest": {
            "length": 110.0,
            "function_hash": "169743852479489588012394093988943530912"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "getFields",
            "file": "services/src/main/java/org/keycloak/utils/SearchQueryUtils.java"
        },
        "deprecated": false,
        "source": "https://github.com/keycloak/keycloak/commit/5d6c91f3309db468b0fe4834e88c3d25649f73e4",
        "id": "CVE-2024-10270-60b39bc5",
        "signature_version": "v1",
        "digest": {
            "length": 457.0,
            "function_hash": "179276353931020872670553594480451907282"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "services/src/main/java/org/keycloak/utils/SearchQueryUtils.java"
        },
        "deprecated": false,
        "source": "https://github.com/keycloak/keycloak/commit/5d6c91f3309db468b0fe4834e88c3d25649f73e4",
        "id": "CVE-2024-10270-891106eb",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "332749973201395277055322781709350695664",
                "211167290917588171390578826305670511504",
                "277537591117917356489906417159512574682",
                "336611960729491992911245283593758781742",
                "122713575193388390108340116245189873669",
                "88519399162914262962222073821816924323",
                "223442238572987983497804736003027308748",
                "160024602509232293475550432066059741225",
                "301005383705882005035087780859659266589",
                "5453036769966635067640867989981855023",
                "241451809980493952726207624760843612728",
                "129564882730434959967915498950822955462",
                "18675333690315843086017976209239140069",
                "83762563318837703229256942733522040261",
                "230966284665842959660313202817249453202",
                "149536964096768919373195028385387247998",
                "298777473810500117063087282230449264361",
                "8356058522226122715150488987140461999",
                "118984191699860390821087228528813968919",
                "31868947511320113972004273040860313575",
                "112689926802652892510106516584880132763",
                "93511694336466657531118219878825345799",
                "246761033337431135974648465665390333255",
                "68252565274498682817613462200892397433",
                "97138399822563933164593046806669991342"
            ]
        },
        "signature_type": "Line"
    }
]
vanir_signatures_modified 
"2026-08-12T15:16:56Z"