| Package | Affected versions | Patched versions |
|---|---|---|
| org.keycloak:keycloak-core | < 2.5.5 | 2.5.5 |
| keycloak | < 2.5.5 | 2.5.5 |
When Keycloak versions prior to 2.5.5 receive a Logout request with an Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in an infinite loop. An attacker could use this flaw to conduct denial of service attacks.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free