-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | < 24.0.9 | 24.0.9 |
| org.keycloak:keycloak-services | maven | >= 25.0.0, < 26.0.6 | 26.0.6 |
Miggo AIRoot Cause AnalysisThe commit diff shows the removal of regex-based parsing (queryPattern and escapedCharsPattern) in SearchQueryUtils.java, replaced with manual character iteration. The added ReDoS test in SearchQueryUtilsTest.java confirms the vulnerability stemmed from regex inefficiency. The getFields() method directly processed untrusted input with these regex patterns, making it the primary vulnerable function. The unescape() method, while less critical, was part of the vulnerable parsing logic and was also removed in the patch.
Ongoing coverage of React2Shell