CVE-2019-10158: Infinispan

Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days.

A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.

Affected products

• Infinispan Infinispan: up to and including 9.4.14
• Red Hat JBoss Data Grid: version 7.0.0 only

Published 2020-01-02. Last modified 2026-06-17.