CVE-2018-10912: Loop with Unreachable Exit Condition ('Infinite Loop')

October 18, 2018 (updated September 14, 2021)

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the server.

References

github.com/advisories/GHSA-h7j7-pw3v-3v3x
nvd.nist.gov/vuln/detail/CVE-2018-10912

Code Behaviors & Features

Detect and mitigate CVE-2018-10912 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →