Moderate severity vulnerability that affects org.keycloak:keycloak-core

published 2018-07-23 8 y ago modified 2026-06-17 4 mo ago also GHSA-h7j7-pw3v-3v3x , EUVD-2018-0613

cvss: 4.4; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.3%; EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits: 0; none known

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the server.

Patch / fix

fixed in 2

maven org.keycloak:keycloak-core 4.0.0
redhat keycloak 4.0.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-10912 updated 2026-11-02 cvss 4.4

keycloak: infinite loop in session replacement leading to denial of service

Red Hat OpenShift Application Runtimes keycloak keycloak Red Hat Single Sign-On 7 rh-sso7-keycloak rh-sso7-keycloak
affected: no fix available
Red Hat Single Sign-On 7.2.4 zip
fixed: vendor fix RHSA-2018:2428
Red Hat Text-Only RHOAR
fixed: vendor fix RHSA-2019:0877
Red Hat Fuse 7 keycloak keycloak Red Hat Mobile Application Platform 4 keycloak
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.31% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	4.4	CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
NVD	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:N/A:P
GitHub	3.1	4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.keycloak:keycloak-core	<4.0.0	4.0.0

Affected products

[UNKNOWN] keycloak

Classification

Weakness

CWE-835 Loop with Unreachable Exit Condition

References

access.redhat.com /errata/RHSA-2018:2428
vendor-advisory
access.redhat.com /errata/RHSA-2019:0877
vendor-advisory
bugzilla.redhat.com /show_bug.cgi?id=CVE-2018-10912
issue-tracking, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2018-10912
advisory
github.com /advisories/GHSA-h7j7-pw3v-3v3x
advisory
github.com /keycloak/keycloak
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary