{"id":"CVE-2017-2646","aliases":["EUVD-2018-0629","GHSA-jc6q-27mw-p55w"],"status":"published","title":"Keycloak vulnerable to infinite loop based Denial of Service","description":"It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.0183,"percentile":0.79009,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2018-07-27T18:00:00Z","modified":"2026-10-24T10:30:15Z","fixes":[{"ecosystem":"Maven","package":"org.keycloak:keycloak-core","fixed_in":["2.5.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.keycloak:keycloak-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.keycloak:keycloak-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5"}]}],"versions":["1.0-alpha-1","1.0-alpha-1-12062013","1.0-alpha-2","1.0-alpha-3","1.0-alpha-4","1.0-beta-1","1.0-beta-1-20150521","1.0-beta-1-20150523","1.0-beta-2","1.0-beta-3","1.0-beta-4","1.0-final","1.0-rc-1","1.0-rc-2","1.0.1.Final","1.0.2.Final","1.0.3.Final","1.0.4.Final","1.0.5.Final","1.1.0.Beta1","1.1.0.Beta2","1.1.0.Final","1.1.1.Final","1.2.0.Beta1","1.2.0.CR1","1.2.0.Final","1.3.0.Final","1.3.1.Final","1.4.0.Final","1.5.0-Final","1.5.0.Final","1.5.1.Final","1.6.0.Final","1.6.1.Final","1.7.0.CR1","1.7.0.Final","1.8.0.Alpha1","1.8.0.CR1","1.8.0.CR2","1.8.0.CR3","1.8.0.Final","1.8.1.Final","1.9.0.CR1","1.9.0.Final","1.9.1.Final","1.9.2.Final","1.9.3.Final","1.9.4.Final","1.9.5.Final","1.9.7.Final","1.9.8.Final","2.0.0.CR1","2.0.0.Final","2.1.0.CR1","2.1.0.Final","2.2.0.CR1","2.2.0.Final","2.2.1.Final","2.3.0.CR1","2.3.0.Final","2.4.0.CR1","2.4.0.Final","2.5.0.CR1","2.5.0.Final","2.5.1.Final","2.5.4.Final"]}],"products":[{"vendor":"keycloak","product":"keycloak"},{"vendor":"red hat","product":"keycloak"},{"vendor":"redhat","product":"keycloak"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2646","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"http://www.securityfocus.com/bid/96882","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2646","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jc6q-27mw-p55w","tags":["advisory"]},{"url":"https://github.com/keycloak/keycloak","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2017-2646","description":"It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks.","status":"published","published":"2018-07-27T18:00:00Z","modified":"2024-08-05T14:02:07.264Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:33:15.543086Z"}],"euvd":[{"id":"EUVD-2018-0629","description":"It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks.","status":"published","published":"2018-07-27T18:00:00Z","modified":"2024-08-05T14:02:07Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T02:39:20.035866Z"}],"ghsa":[{"id":"GHSA-jc6q-27mw-p55w","title":"Keycloak vulnerable to infinite loop based Denial of Service","description":"When Keycloak versions prior to 2.5.5 receive a Logout request with an Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in an infinite loop. An attacker could use this flaw to conduct denial of service attacks.","status":"published","published":"2018-10-18T16:49:29Z","modified":"2023-01-08T05:02:40Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:36:01.39976Z"}],"nvd":[{"id":"CVE-2017-2646","description":"It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks.","status":"published","published":"2018-07-27T18:29:01.017Z","modified":"2026-06-17T01:16:35.007Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:04:18.679411Z"}],"osv":[{"id":"CVE-2017-2646","description":"It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks.","status":"published","published":"2018-07-27T18:29:01.017Z","modified":"2026-10-24T10:30:15.060252322Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"GHSA-jc6q-27mw-p55w","title":"Keycloak vulnerable to infinite loop based Denial of Service","description":"When Keycloak versions prior to 2.5.5 receive a Logout request with an Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in an infinite loop. An attacker could use this flaw to conduct denial of service attacks.","status":"published","published":"2018-10-18T16:49:29Z","modified":"2023-11-08T03:59:19.487959Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:46:50.336262Z"}]}}