CVE-2026-11312: bytedance InfiniStore KV Map infinistore.h purge_kv_map algorithmic complexity
A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purgekvmap in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
bytedance InfiniStore (KV Map Handler)from your environment.If the KV Map Handler is not required, uninstall or disable the KV Map Handler component from affected installations to eliminate exposure.
- Compensating control
Restrict local access to hosts running bytedance InfiniStore. Use host-based access controls (local firewall, SELinux/AppArmor profiles, user/group restrictions) to prevent untrusted local users or processes from interacting with the KV Map Handler, since the exploit requires a local approach.
- Operational
Do not run affected releases (versions up to 0.2.33). If you are running a release up to 0.2.33, isolate or shut down those instances until a vendor fix is available; monitor the project for an official patch or advisory and apply it when released. Also monitor hosts for signs of exploitation using available logs.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11312?
CVE-2026-11312 has a low severity rating of 3.3.
How do I fix CVE-2026-11312?
Fixing CVE-2026-11312 involves updating to a patched version of ByteDance InfiniStore beyond version 0.2.33.
What component is affected by CVE-2026-11312?
CVE-2026-11312 affects the KV Map Handler in the purging function within infinistore.h.
Is CVE-2026-11312 a remote vulnerability?
No, CVE-2026-11312 requires a local attack vector to exploit the vulnerability.
What kind of attack can exploit CVE-2026-11312?
CVE-2026-11312 can be exploited through inefficient algorithmic complexity manipulation within the KV Map Handler.