CVE-2023-5236: Infinispan: circular reference on marshalling leads to dos

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-18 · updated 2026-06-17

Description

A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.

Affected products

Red Hat infinispan: all versions
RedHat Data Grid: before 8.4.4 — fixed in 8.4.4
RedHat Jboss Data Grid: all versions

How to fix

Upgrade to a fixed version: RedHat Data Grid 8.4.4. Check the vendor advisory for mitigations.

References

https://access.redhat.com/errata/RHSA-2023:5396
https://access.redhat.com/security/cve/CVE-2023-5236
https://bugzilla.redhat.com/show_bug.cgi?id=2240999
https://access.redhat.com/errata/RHSA-2023:5396
https://access.redhat.com/security/cve/CVE-2023-5236
https://bugzilla.redhat.com/show_bug.cgi?id=2240999
https://security.netapp.com/advisory/ntap-20240125-0004/

Get alerted when CVE-2023-5236 or the next vulnerability affects your stack