CVE-2020-10758: Allocation of Resources Without Limits or Throttling

February 9, 2022

A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, all with a Content-Length header value that exceeds the actual byte count of the request body.

References

bugzilla.redhat.com/show_bug.cgi?id=1843849
github.com/advisories/GHSA-52rg-hpwq-qp56
github.com/keycloak/keycloak/commit/bee4ca89897766c4b68856eafe14f1a3dad34251
nvd.nist.gov/vuln/detail/CVE-2020-10758

Code Behaviors & Features

Detect and mitigate CVE-2020-10758 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →