{"id":"CVE-2024-10270","published":"2024-11-25T07:37:04Z","modified":"2026-10-13T18:44:43Z","title":"Org.keycloak:keycloak-services: keycloak denial of service","vendor":"Red Hat","product":"Red Hat build of Keycloak 24","tier":"tail","description":{"text":"A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01245,"percentile":0.69184,"provenance":"source"},"cwes":[{"id":"CWE-1333","name":"Inefficient Regular Expression Complexity"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:10175","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10176","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10177","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10178","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-10270","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2321214","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/advisories/GHSA-wq8x-cg39-8mrr","tags":[]},{"url":"https://github.com/keycloak/keycloak/commit/5d6c91f3309db468b0fe4834e88c3d25649f73e4","tags":[]}],"priority":{"score":18.4,"factors":[{"name":"EPSS percentile","points":13.84},{"name":"CVSS severity","points":4.55}]},"vendorSlug":"red-hat","affectedVersions":[{"vendor":null,"product":null,"versions":["< 24.0.9",">= 25.0.0, < 26.0.6"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 24","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 24","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 24","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.0","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.0","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.0","versions":["all versions"]}],"affected":[{"ecosystem":"Maven","package":"org.keycloak:keycloak-services","vulnerableRanges":["<24.0.9",">=25.0.0, <26.0.6"],"patched":["24.0.9","26.0.6"],"from":["GHSA-wq8x-cg39-8mrr"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-3389","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-7341","published":"2024-09-09","fixed":"25.0.5","kev":false},{"cve":"CVE-2024-8883","published":"2024-09-19","fixed":"25.0.6","kev":false,"link":{"from":"CVE-2024-8883","to":"CVE-2024-10270","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.keycloak:keycloak-services","fromFixed":"24.0.8","toFixed":"24.0.9","daysApart":67}]}},{"cve":"CVE-2025-12390","published":"2025-10-28","fixed":"26.0.0","kev":false},{"cve":"CVE-2024-10270","published":"2024-11-25","fixed":"26.0.6","kev":false},{"cve":"CVE-2025-1391","published":"2025-02-17","fixed":"26.1.3","kev":false,"link":{"from":"CVE-2024-10270","to":"CVE-2025-1391","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.keycloak:keycloak-services","fromFixed":"26.0.6","toFixed":"26.0.10","daysApart":84}]}},{"cve":"CVE-2025-3501","published":"2025-04-29","fixed":"26.2.2","kev":false},{"cve":"CVE-2025-3910","published":"2025-04-29","fixed":"26.2.2","kev":false}],"package":"Maven:org.keycloak:keycloak-services"}}