CVE-2023-5236: Infinispan

Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days.

A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.

Affected products

• Infinispan Infinispan: affected versions not specified
• Red Hat Data Grid: before 8.4.4 (fixed in 8.4.4)
• Red Hat JBoss Data Grid: affected versions not specified

Published 2023-12-18. Last modified 2026-06-17.