CVE-2017-2646

CVE-2017-2646 describes a denial-of-service vulnerability affecting Red Hat Keycloak versions prior to 2.5.5. This flaw occurs when Keycloak processes a crafted SAML Logout request containing extensions in an unexpected location, leading to an infinite loop within the SAMLSloRequestParser.parse() method. Rated with a CVSS score of 7.5 (High), this vulnerability is remotely exploitable with low attack complexity and no user interaction required, allowing an unauthenticated attacker to cause a denial of service. The potential impact is high availability loss. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a low level of public awareness or concern.