CVE-2018-10912 – keycloak: infinite loop in session replacement leading to denial of service

https://notcve.org/view.php?id=CVE-2018-10912

23 Jul 2018 — keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the server. keycloak en versiones anteriores a la 4.0.0.final es vulnerable a un bucle infinito en el reemplazo de sesiones. Un clúster de Keycloak con múltiples nodos podría gestionar erróneamente un reemplazo de sesión... • https://access.redhat.com/errata/RHSA-2018:2428 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •