CVE-2023-5236: Infinispan: circular reference on marshalling leads to dos
A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.
Other sources
Sending data to RHDG configured with Protostream serialization (which is our recommended configuration), which contains circular object references will cause it to go into an infinite loop until it maxes out the thread stack.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-5236?
CVE-2023-5236 has been classified as a moderate severity vulnerability.
How do I fix CVE-2023-5236?
To fix CVE-2023-5236, it is recommended to upgrade to Infinispan version 4.6.2.Final or higher.
What software is affected by CVE-2023-5236?
CVE-2023-5236 affects Infinispan, Red Hat Data Grid, and JBoss Data Grid software.
Can CVE-2023-5236 lead to denial of service?
Yes, CVE-2023-5236 can lead to denial of service by causing out of memory errors.
Who can exploit CVE-2023-5236?
An authenticated attacker with sufficient permissions can exploit CVE-2023-5236 to insert a maliciously constructed object.