Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2023-6563

CVE-2023-6563HIGH

Red Hat Red Hat Single Sign-On 7.6 for RHEL 7 — Keycloak: offline session token dos

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  C  N  N  H    7.7   .0124   68.1     —

AFFECTED
  Product                                Versions     Fixed
  Red Hat Single Sign-On 7.6 for RHEL 7  unspecified  0:18.0.11-2.redhat_00003.1.el7sso
  Red Hat Single Sign-On 7.6 for RHEL 8  unspecified  0:18.0.11-2.redhat_00003.1.el8sso
  Red Hat Single Sign-On 7.6 for RHEL 9  unspecified  0:18.0.11-2.redhat_00003.1.el9sso
  RHEL-8 based Middleware Containers     unspecified  7.6-38
  RHEL-8 based Middleware Containers     unspecified  7.6.6-2
  Single Sign-On 7.6.6                   unspecified  —
  Red Hat Build of Keycloak              unspecified  —

TIMELINE
  Dec 6   Reserved by redhat
  Dec 14  Published (CNA: redhat)
  Sep 22  EXPLOIT PUBLISHED — CVE-2023-6563 (Red Hat Single Sign-On 7.6 for RHEL 7). Public exploit reference added.

CWE-770 · CNA: redhat · CVSS v3.1 · 8 references · NVD status: Modified

Description

An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
December 6, 2023	Reserved	Reserved by redhat
December 14, 2023	Published	Published (CNA: redhat)
September 22, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2023-6563 (Red Hat Single Sign-On 7.6 for RHEL 7). Public exploit reference added.

Affected

Affected products and packages — 7 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 7	—	—	0:18.0.11-2.redhat_00003.1.el7sso
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 8	—	—	0:18.0.11-2.redhat_00003.1.el8sso
Red Hat	Red Hat Single Sign-On 7.6 for RHEL 9	—	—	0:18.0.11-2.redhat_00003.1.el9sso
Red Hat	RHEL-8 based Middleware Containers	—	—	7.6-38
Red Hat	RHEL-8 based Middleware Containers	—	—	7.6.6-2
Red Hat	Single Sign-On 7.6.6	—	—	—
Red Hat	Red Hat Build of Keycloak	—	—	—

Weaknesses

CWE-770

References (8)

https://access.redhat.com/errata/RHSA-2023:7854 [Vendor Advisory]
https://access.redhat.com/errata/RHSA-2023:7855 [Vendor Advisory]
https://access.redhat.com/errata/RHSA-2023:7856 [Vendor Advisory]
https://access.redhat.com/errata/RHSA-2023:7857 [Exploit]
https://access.redhat.com/errata/RHSA-2023:7858 [Vendor Advisory]
https://access.redhat.com/security/cve/CVE-2023-6563 [Vendor Advisory]
https://bugzilla.redhat.com/show_bug.cgi?id=2253308 [Issue Tracking]
https://github.com/keycloak/keycloak/issues/13340 [Issue Tracking]

Authoritative record: CVE-2023-6563 at cve.org

Vendors: red hat

Weaknesses: CWE-770

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2023-6563 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.