title: Keycloak: offline session token dos
description: An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system.
problem types: Allocation of Resources Without Limits or Throttling
affected:
{
product: keycloak
vendor: n/a
versions:
version: 21.0.0, status: unaffected
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.11-2.redhat_00003.1.el7sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el7
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.11-2.redhat_00003.1.el8sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el8
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.11-2.redhat_00003.1.el9sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el9
}
{
vendor: Red Hat
product: RHEL-8 based Middleware Containers
collectionURL: https://catalog.redhat.com/software/containers/
packageName: rh-sso-7/sso76-openshift-rhel8
defaultStatus: affected
versions:
version: 7.6-38, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:rhosemc:1.0::el8
}
{
vendor: Red Hat
product: RHEL-8 based Middleware Containers
collectionURL: https://catalog.redhat.com/software/containers/
packageName: rh-sso-7/sso7-rhel8-operator-bundle
defaultStatus: affected
versions:
version: 7.6.6-2, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:rhosemc:1.0::el8
}
{
vendor: Red Hat
product: Single Sign-On 7.6.6
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
defaultStatus: unaffected
packageName: keycloak-core
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6.6
}
{
vendor: Red Hat
product: Red Hat Build of Keycloak
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: keycloak-core
defaultStatus: affected
cpes: cpe:/a:redhat:build_keycloak:22
}
metrics:
other: [
content: {'value': 'Important', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]
workarounds: There are three main options to prevent exploitation:
1) If you are using a reverse proxy, block the consents URL.
2) This option is less effective: remove the consents application tab from the account console theme.
3) This option has a significant negative impact on end users: entirely disable offline user profiles.