CVE-2014-3651

High

Published: 29/12/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR code generation.

Risk Assessment

Attackers can exploit this vulnerability to overload the server, potentially leading to service unavailability for users.

Recommendation

It is recommended to upgrade JBoss KeyCloak to version 1.0.3.Final or later to mitigate the risk associated with this vulnerability.

Other vulnerabilities in JBoss KeyCloak

CVE-2014-3709High
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before version 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks due to lack of CSRF protection.

Original NVD description (English source)

JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR code generation.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS