CVE-2024-6875: Infinispan: infinispan: rest compare api has buffer leak
A vulnerability was found in the Infinispan component in Red Hat Data Grid. The REST compare API may have a buffer leak and an out of memory error can occur when sending continual requests with large POST data to the REST API.
Other sources
The REST compare API has buffer leak issue in RHDG, and I have confirmed that "OutOfMemoryError: Direct buffer memory" can occur when sending a request with some extent size of POST data (like 1MiB) to the REST API continually.
As the REST endpoint is secured (= authentication is required) by default in RHDG, it's not possible for anonymous attackers to utilize this issue. However, a malicious user can utilize this issue for DoS attack. Hence.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6875?
CVE-2024-6875 is classified as a medium severity vulnerability due to its potential to cause denial of service through out of memory errors.
How do I fix CVE-2024-6875?
To fix CVE-2024-6875, you should update to the latest version of Red Hat Data Grid or apply the recommended patches provided by Red Hat.
What component is affected by CVE-2024-6875?
CVE-2024-6875 affects the Infinispan component in Red Hat Data Grid's REST compare API.
What is the nature of the issue in CVE-2024-6875?
CVE-2024-6875 involves a buffer leak that can lead to out of memory errors when extensive requests with large payloads are sent to the REST API.
Who is impacted by CVE-2024-6875?
Users of Red Hat Data Grid and Infinispan who utilize the REST compare API are impacted by CVE-2024-6875.