Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17

Export CSV
CVE-2023-5236

Infinispan: circular reference on marshalling leads to dos

A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.

CVSS 3.1 · 4.4 Medium EPSS 1.1% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan Camel Quarkus Camel Spring Boot and 9 more
CVE-2026-119542

Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a stackoverflowerror

A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULK_READ permission who can submit a cache query may trigger the issue, potentially affecting availability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan Build Of Apache Camel For Quarkus Camel Quarkus and 7 more
CVE-2025-5731

Infinispan: credential leakage in infinispan cli

A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan Data Grid Jboss Data Grid and 3 more
CVE-2023-4586

Hotrod-client: hot rod client does not enable hostname validation when using tls that lead to a mitm attack

A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Infinispan Redhat
Products
Hot Rod Data Grid Jboss Data Grid
CVE-2023-5384

Infinispan: credentials returned from configuration as clear text

A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan Data Grid Jboss Data Grid
CVE-2023-3629

Infinispan: non-admins should not be able to get cache config via rest api

A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan Data Grid Jboss Data Grid and 1 more
CVE-2023-3628

Infispan: rest bulk ops don't check permissions

A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan Data Grid Jboss Data Grid and 1 more
CVE-2019-10158

infinispan: Session fixation protection broken for Spring Session integration

A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.

CVSS 3.1 · 9.8 Critical EPSS 2.0% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan Jboss Data Grid
CVE-2021-31917

Infinispan: Authentication bypass on REST endpoints when using DIGEST authentication mechanism

A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all REST endpoints when DIGEST is used as the authentication method. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan-server-rest Data Grid Jboss Data Grid
CVE-2020-25711

infinispan: authorization check missing for server management operations

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Infinispan Netapp Redhat
Products
Infinispan Active Iq Unified Manager Data Grid and 1 more
CVE-2020-10771

infinispan-server-rest: Actions with effects should not be permitted via GET requests using REST API

A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an attacker to perform a cross-site request forgery (CSRF) attack.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Infinispan Netapp Redhat
Products
Infinispan-server-rest Oncommand Insight Data Grid and 1 more
CVE-2020-10746

Infinispan: REST and HotRod APIs unsecured locally by default

A flaw was found in Infinispan (org.infinispan:infinispan-server-runtime) version 10, where it permits local access to controls via both REST and HotRod APIs. This flaw allows a user authenticated to the local machine to perform all operations on the caches, including the creation, update, deletion, and shutdown of the entire server.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan-server-runtime Jboss Data Grid
CVE-2019-10174

infinispan: invokeAccessibly method from ReflectionUtil class allows to invoke private methods

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.

CVSS 3.1 · 8.8 High EPSS 3.1% KEV · Not listed
Vendors
Infinispan Netapp Redhat
Products
Infinispan Active Iq Unified Manager Enterprise Linux and 9 more
CVE-2018-1131

infinispan: deserialization of data in XML and JSON transcoders

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.

CVSS 3.0 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan Jboss Data Grid Jboss Fuse
CVE-2017-2638

infinispan: auth bypass in REST api

It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.

CVSS 3.0 · 6.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan Jboss Data Grid
CVE-2017-15089

infinispan: Unsafe deserialization of malicious object injected into data cache

It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.

CVSS 3.0 · 8.8 High EPSS 2.8% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan Jboss Data Grid Jboss Enterprise Application Platform and 3 more
CVE-2016-0750

client: unchecked deserialization in marshaller util

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.

CVSS 3.0 · 4.2 Medium EPSS 2.4% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan Jboss Data Grid Jboss Single Sign On