PT-2023-31964 · Unknown · Infinispan

Chess Hazlett · Published 2023-12-18 · Updated 2025-09-25 · CVE-2023-5236

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Infinispan (affected versions not specified)

Description A flaw was found in the software, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-1047

Related Identifiers

CVE-2023-5236

GHSA-488M-W9FP-5MM2

Affected Products

Infinispan

References · 18

• https://access.redhat.com/errata/RHSA-2023:5396 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2023-5236 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-5236 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5236 · Security Note
• https://osv.dev/vulnerability/GHSA-488m-w9fp-5mm2 · Vendor Advisory
• https://github.com/infinispan/infinispan · Note
• https://github.com/infinispan/protostream/commit/4501b6b307a6bab545346f66238f8be7e42f83eb · Note
• https://github.com/infinispan/protostream/commit/4ef66958f2c4890ae1c6a7acd629d27bd88aa4cb · Note
• https://github.com/infinispan/protostream/commit/50320b5987dc87bc04b616b87e8cf93472ee19c1 · Note
• https://t.me/cveNotify/136370 · Telegram Post
• https://issues.redhat.com/browse/IPROTO-262 · Note
• https://issues.redhat.com/browse/IPROTO-263 · Note
• https://t.me/cvenotify/68662 · Telegram Post
• https://security.netapp.com/advisory/ntap-20240125-0004 · Note
• https://issues.redhat.com/browse/ISPN-14534 · Note