Skip to content

Infinispan circular object references causes out of memory errors

Moderate severity GitHub Reviewed Published Dec 28, 2023 to the GitHub Advisory Database • Updated Sep 16, 2024

Package

maven org.infinispan.protostream:protostream (Maven)

Affected versions

< 4.6.2.Final

Patched versions

4.6.2.Final

Description

A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.

References

Published by the National Vulnerability Database Dec 18, 2023
Published to the GitHub Advisory Database Dec 28, 2023
Reviewed Sep 16, 2024
Last updated Sep 16, 2024

Severity

Moderate

EPSS score

0.052%
(22nd percentile)

Weaknesses

CVE ID

CVE-2023-5236

GHSA ID

GHSA-488m-w9fp-5mm2

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.