Infinispan: Deserialization of untrusted data in the Hot Rod Java client via automatic byte-array deserialization

published 2018-09-11 8 y ago modified 2026-07-10 4 mo ago also GHSA-4hhg-8ghq-vwq6 , EUVD-2016-0773

cvss: 4.2; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 2.4%; EPSS 2.4% chance of exploitation in 30 days, percentile 84%
public exploits: 0; none known

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.

Patch / fix

fixed in 2 links 1

maven org.infinispan:infinispan-core 9.1.0.Final
infinispan infinispan 9.1.0

github.com/infinispan/infinispan#5116 pull request

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-0750 updated 2026-06-30 cvss 4.2

client: unchecked deserialization in marshaller util

Red Hat JBoss Data Grid 6 hotrod-client hotrod-client
under investigation
Red Hat JBoss Data Grid 7.1
fixed: vendor fix RHSA-2017:3244
Red Hat Single Sign-On 7.2.1 zip
fixed: vendor fix RHSA-2018:0501

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.42% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	3.0	4.2	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P
GitHub	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	org.infinispan:infinispan-core	<9.1.0.Final	9.1.0.Final

Affected products

Red Hat Infinispan

Classification

Weakness

CWE-138 Improper Neutralization of Special Elements
CWE-502 Deserialization of Untrusted Data

References

github.com /infinispan/infinispan/pull/5116
web, patch, vendor-advisory
access.redhat.com /errata/RHSA-2018:0501
vendor-advisory, web
access.redhat.com /errata/RHSA-2017:3244
vendor-advisory, web
bugzilla.redhat.com /show_bug.cgi?id=CVE-2016-0750
web, issue-tracking, vendor-advisory
issues.jboss.org /browse/ISPN-7781
web, issue-tracking, third-party-advisory
securityfocus.com /bid/101910
vdb-entry, web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2016-0750
advisory
github.com /infinispan/infinispan
package

Sources

CVE List CVE-2016-0750
GitHub Advisory GHSA-4hhg-8ghq-vwq6
NVD CVE-2016-0750

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary