CVE-2024-11734

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-11734
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-11734.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-11734
Aliases
Related
Published
2025-01-14T08:35:42.107Z
Modified
2026-07-16T03:46:37.413085335Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Org.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headers
Details

A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm settings to disrupt the service. This action is done by modifying any of the security headers and inserting newlines, which causes the Keycloak server to write to a request that has already been terminated, leading to the failure of said request.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11734.json",
    "cwe_ids": [
        "CWE-693"
    ],
    "cna_assigner": "redhat"
}
References

Affected packages

Git / github.com/keycloak/keycloak

Affected ranges

Type
GIT
Repo
https://github.com/keycloak/keycloak
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9ca0ccddbf9a69d84c8d3391a86251a96ff47ca7
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "26.0.8"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.0-alpha-1
1.0-alpha-1-12062013
1.0-alpha-2
1.0-alpha-3
1.0-beta-1
1.0-beta-2
1.0-beta-4
1.0-final
1.0-rc-1
1.0.0.Final
1.1.0.Beta2
1.3.0.Final
2.*
2.4.0.Test

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-11734.json"