GitHub Advisoryadvisory · Maven

GHSA-4hhg-8ghq-vwq6 Infinispan: Deserialization of untrusted data in the Hot Rod Java client via automatic byte-array deserialization

HIGH Published 2022-05-13 Modified 2026-07-10 Official page ↗
Aliases
CVE-2016-0750
Ecosystem
Maven
Packages
org.infinispan:infinispan-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2026-07-10

Affected packages

• Maven org.infinispan:infinispan-core: < 9.1.0.Final → fixed in 9.1.0.Final

Description

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.

Related

Alias · CVE (1)

  • CVE-2016-0750 The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References