CVE-2023-5236
Infinispan: circular reference on marshalling leads to dos
A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Infinispan: circular reference on marshalling leads to dos
A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.
- Record
CVE-2023-5236- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-07
EUVDEUVD-2023-3094
A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.
- Record
EUVD-2023-3094- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-07
GitHub AdvisoriesGHSA-488m-w9fp-5mm2
Infinispan circular object references causes out of memory errors
A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.
- Record
GHSA-488m-w9fp-5mm2- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1047
- Updated
- 2026-11-02
NVD
A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.
- Record
CVE-2023-5236- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-07
OSVGHSA-488m-w9fp-5mm2
Infinispan circular object references causes out of memory errors
A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.
- Record
GHSA-488m-w9fp-5mm2- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1047
- Updated
- 2026-11-02
Affected products
- infinispan
- red hat build of apache camel 4 for quarkus 3
- red hat build of apache camel for spring boot 4
- red hat build of debezium 2
- red hat build of debezium 3
- red hat build of quarkus
- red hat data grid 8
- red hat data grid 8.4.4
- red hat fuse 7
- red hat jboss enterprise application platform 7
- red hat jboss enterprise application platform 8
- red hat jboss enterprise application platform expansion pack
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.infinispan.protostream:protostreamMaven |
before 4.6.2.Final | 4.6.2.Final |
org.infinispan.protostream:protostreamMaven |
before 4.6.2.Final, plus listed versions 1.0.0.Alpha11.0.0.Alpha21.0.0.Alpha31.0.0.Alpha41.0.0.Alpha5 Show 45 moreShow less1.0.0.Alpha61.0.0.Alpha71.0.0.CR11.0.0.Final1.0.1.Final1.0.2.Final2.0.0.Alpha12.0.0.Alpha22.0.0.Alpha32.0.0.Alpha42.0.0.Final2.0.1.Final2.0.2.Final2.0.3.Final3.0.0.Alpha13.0.0.Alpha23.0.0.Alpha33.0.0.Alpha43.0.0.Alpha53.0.0.Alpha63.0.0.Alpha73.0.0.Alpha83.0.0.Alpha93.0.0.Final3.0.1.Alpha13.0.1.Final3.0.2.Final3.0.3.Final3.0.4.Final3.0.5.Final3.0.6.Final3.0.7.Final4.0.0.Alpha14.0.0.Alpha24.0.0.Alpha34.0.0.Alpha44.0.0.Alpha54.0.0.Alpha64.0.0.Alpha74.0.0.Alpha84.0.0.Alpha94.0.0.CR14.0.0.CR24.0.0.CR34.0.0.Final |
4.6.2.Final |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-5236 is a medium vulnerability (CVSS 4.4) in Infinispan, published December 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.11%, the 66th percentile. Fixed in org.infinispan.protostream:protostream 4.6.2.Final.
References
access.redhat.com/errata/RHSA-2023:5396
bugzilla.redhat.com/show_bug.cgi?id=2240999
security.netapp.com/advisory/ntap-20240125-0004
nvd.nist.gov/vuln/detail/CVE-2023-5236
github.com/infinispan/protostream/commit/4501b6b307a6bab545346f66238f8be7e42f83eb
Show 7 moreShow less
issues.redhat.com/browse/IPROTO-262
Left out here: 69 versions. The JSON record has them.