CVE-2023-5236: Infinispan: circular reference on marshalling leads to dos

Published Sep 27, 2023
·
Updated

A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.

Other sources

Sending data to RHDG configured with Protostream serialization (which is our recommended configuration), which contains circular object references will cause it to go into an infinite loop until it maxes out the thread stack.

Red Hat

Affected Software

4 affected componentsFixes available
maven/org.infinispan.protostream:protostream<4.6.2.Final
4.6.2.Final
redhat Data Grid<8.4.4
redhat Jboss Data Grid
infinispan Infinispan

Event History

Sep 27, 2023
Data Sourced
via Red Hat·04:14 PM
DescriptionSeverityAffected Software
Dec 18, 2023
CVE Published
via MITRE·01:43 PM
Data Sourced
via MITRE·01:43 PM
DescriptionSeverity
Data Sourced
via NVD·02:15 PM
DescriptionSeverityAffected Software
Dec 28, 2023
Advisory Published
via GitHub·09:30 PM

Frequently Asked Questions

1

What is the severity of CVE-2023-5236?

CVE-2023-5236 has been classified as a moderate severity vulnerability.

2

How do I fix CVE-2023-5236?

To fix CVE-2023-5236, it is recommended to upgrade to Infinispan version 4.6.2.Final or higher.

3

What software is affected by CVE-2023-5236?

CVE-2023-5236 affects Infinispan, Red Hat Data Grid, and JBoss Data Grid software.

4

Can CVE-2023-5236 lead to denial of service?

Yes, CVE-2023-5236 can lead to denial of service by causing out of memory errors.

5

Who can exploit CVE-2023-5236?

An authenticated attacker with sufficient permissions can exploit CVE-2023-5236 to insert a maliciously constructed object.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203