indepth analysis: https://docs.google.com/document/d/1XdX8AJzGjBgCLE0UZ5NRGGrzQ14HSVS8HcDgH0X70w/edit?tab=t.d440c4doqxdr#bookmark=kix.x2zmvwn62x0k
default JGroups protocol stacks ship without the AUTH protocol, allowing any network-adjacent host to join the cluster, and the Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.
The root cause is CWE-502 (Deserialization of Untrusted Data) in the session replication marshalling path, combined with CWE-306 (Missing Authentication for Critical Function) on the JGroups cluster join interface. CVE-2016-2141 addressed AUTH bypass when AUTH was configured, but did not add AUTH to default stacks. CVE-2025-2251 addresses the same River unmarshaller deficiency in the EJB remote invocation path only — the fix commit (2656bb7) modified only ejb3/src/main/java/org/jboss/as/ejb3/subsystem/FilterSpecClassResolverFilter.java, leaving the Infinispan clustering marshaller completely unprotected.
Fix must add ClassResolverFilter to the SessionMarshallerFactory.JBOSS / JBossByteBufferMarshaller path in wildfly-clustering-web-extension
Withdrawn Advisory This advisory has been withdrawn because the underlying vulnerability only concerns Red Hat's Hot Rod client, which is not in one of the GitHub Advisory Database's supported ecosystems. This link is maintained to preserve external references.
Original Description Netty-handler has been found to no validate hostnames when using TLS in its default configuration. As a result netty-handler is vulnerable to man-in-the-middle attacks. Users would need to set the protocol to "HTTPS" in the SSLParameters of the SSLEngine to opt in to host name validation. A change in default behavior is expected in the 5.x release branch with no backport planned.
In the interim users are advised to enable host name validation in their configurations. See https://github.com/netty/netty/issues/8537 for details on the forthcoming change in default behavior.
A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.
It was discovered that the hotrod java client in infinispan automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.
code link: https://github.com/infinispan/infinispan/blob/master/client/hotrod-client/src/main/java/org/infinispan/client/hotrod/marshall/MarshallerUtil.java#L39
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0) where an attacker can bypass authentication in a trivial manor on all REST endpoints when DIGEST is used as the authentication method (authentication mechanisms).