{"id":"CVE-2016-0750","aliases":["EUVD-2016-0773","GHSA-4hhg-8ghq-vwq6","OESA-2021-1139"],"status":"published","title":"Infinispan: Deserialization of untrusted data in the Hot Rod Java client via automatic byte-array deserialization","description":"The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.","severity":{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.02419,"percentile":0.84259,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-138","CWE-502"],"published":"2018-09-11T13:00:00Z","modified":"2026-10-20T10:46:40Z","fixes":[{"ecosystem":"Maven","package":"org.infinispan:infinispan-core","fixed_in":["9.1.0.Final"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.infinispan:infinispan-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0.Final"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.infinispan:infinispan-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0.Final"}]}],"versions":["5.0.0.FINAL","5.0.1.FINAL","5.1.0.ALPHA1","5.1.0.ALPHA2","5.1.0.BETA1","5.1.0.BETA2","5.1.0.BETA3","5.1.0.BETA4","5.1.0.BETA5","5.1.0.CR1","5.1.0.CR2","5.1.0.CR3","5.1.0.CR4","5.1.0.FINAL","5.1.1.CR1","5.1.1.FINAL","5.1.2.CR1","5.1.2.FINAL","5.1.3.CR1","5.1.3.FINAL","5.1.4.CR1","5.1.4.FINAL","5.1.5.CR1","5.1.5.FINAL","5.1.6.FINAL","5.1.7.Final","5.1.8.Final","5.2.0.ALPHA1","5.2.0.ALPHA2","5.2.0.Alpha3","5.2.0.Alpha4","5.2.0.Beta1","5.2.0.Beta2","5.2.0.Beta3","5.2.0.Beta4","5.2.0.Beta5","5.2.0.Beta6","5.2.0.CR1","5.2.0.CR2","5.2.0.CR3","5.2.0.Final","5.2.1.Final","5.2.10.Final","5.2.11.CR1","5.2.11.Final","5.2.12.Final","5.2.13.Final","5.2.14.Final","5.2.15.Final","5.2.18.Final","5.2.19.Final","5.2.2.Final","5.2.20.Final","5.2.3.Final","5.2.4.Final","5.2.5.Final","5.2.6.Final","5.2.7-wolfc-1","5.2.7.Final","5.2.8.CR1","5.2.8.Final","5.2.9.Final","5.3.0.Alpha1","5.3.0.Beta1","5.3.0.Beta2","5.3.0.CR1","5.3.0.CR2","5.3.0.Final","6.0.0.Alpha1","6.0.0.Alpha2","6.0.0.Alpha3","6.0.0.Alpha4","6.0.0.Beta1","6.0.0.Beta2","6.0.0.CR1","6.0.0.Final","6.0.1.Final","6.0.2.Final","7.0.0.Alpha1","7.0.0.Alpha2","7.0.0.Alpha3","7.0.0.Alpha4","7.0.0.Alpha5","7.0.0.Beta1","7.0.0.Beta2","7.0.0.CR1","7.0.0.CR2","7.0.0.Final","7.0.1.Final","7.0.2.Final","7.0.3.Final","7.1.0.Alpha1","7.1.0.Beta1","7.1.0.CR1","7.1.0.CR2","7.1.0.Final","7.1.1.Final","7.2.0.Alpha1","7.2.0.Beta1","7.2.0.Beta2","7.2.0.CR1","7.2.0.Final","7.2.1.Final","7.2.2.Final","7.2.3.Final","7.2.4.Final","7.2.5.Final","8.0.0.Alpha1","8.0.0.Alpha2","8.0.0.Beta1","8.0.0.Beta2","8.0.0.Beta3","8.0.0.CR1","8.0.0.Final","8.0.1.Final","8.0.2.Final","8.1.0.Alpha1","8.1.0.Alpha2","8.1.0.Beta1","8.1.0.CR1","8.1.0.Final","8.1.1.Final","8.1.2.Final","8.1.3.Final","8.1.4.Final","8.1.5.Final","8.1.6.Final","8.1.7.Final","8.1.8.Final","8.1.9.Final","8.2.0.Beta1","8.2.0.Beta2","8.2.0.CR1","8.2.0.Final","8.2.1.Final","8.2.10.Final","8.2.11.Final","8.2.12.Final","8.2.2.Final","8.2.3.Final","8.2.4.Final","8.2.5.Final","8.2.6.Final","8.2.7.Final","8.2.8.Final","9.0.0.Alpha1","9.0.0.Alpha2","9.0.0.Alpha3","9.0.0.Alpha4","9.0.0.Beta1","9.0.0.Beta2","9.0.0.CR1","9.0.0.CR2","9.0.0.CR3","9.0.0.CR4","9.0.0.Final","9.0.1.Final","9.0.2.Final","9.0.3.Final","9.1.0.Alpha1","9.1.0.Beta1","9.1.0.CR1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"infinispan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.4-8.oe1"}]}],"bundled":2}],"products":[{"vendor":"infinispan","product":"infinispan"},{"vendor":"red hat","product":"infinispan"}],"references":[{"url":"https://issues.jboss.org/browse/ISPN-7781","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"http://www.securityfocus.com/bid/101910","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://github.com/infinispan/infinispan/pull/5116","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0501","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3244","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0750","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0750","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4hhg-8ghq-vwq6"},{"url":"https://github.com/infinispan/infinispan","tags":["package"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1139","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15089","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-0750","description":"The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.","status":"published","published":"2018-09-11T13:00:00Z","modified":"2024-08-05T22:30:04.027Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-138"],"updated_at":"2026-11-02T14:33:37.12286Z"}],"euvd":[{"id":"EUVD-2016-0773","description":"The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.","status":"published","published":"2018-09-11T13:00:00Z","modified":"2024-08-05T22:30:04Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T02:23:00.426765Z"}],"ghsa":[{"id":"GHSA-4hhg-8ghq-vwq6","title":"Infinispan: Deserialization of untrusted data in the Hot Rod Java client via automatic byte-array deserialization","description":"The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.","status":"published","published":"2022-05-13T01:38:51Z","modified":"2026-07-10T14:32:58Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:40:42.703776Z"}],"nvd":[{"id":"CVE-2016-0750","description":"The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.","status":"published","published":"2018-09-11T13:29:00.433Z","modified":"2026-06-17T00:38:08.767Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-138","CWE-502"],"updated_at":"2026-11-02T14:03:39.621168Z"}],"osv":[{"id":"CVE-2016-0750","description":"The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.","status":"published","published":"2018-09-11T13:29:00.433Z","modified":"2026-10-20T10:46:40.452291378Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"GHSA-4hhg-8ghq-vwq6","title":"Infinispan: Deserialization of untrusted data in the Hot Rod Java client via automatic byte-array deserialization","description":"The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.","status":"published","published":"2022-05-13T01:38:51Z","modified":"2026-07-10T14:56:40.111261Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"OESA-2021-1139","title":"infinispan security update","description":"Infinispan is an extremely scalable, highly available data grid platform - 100% open source, and written in Java. The purpose of Infinispan is to expose a data structure that is highly concurrent, designed ground-up to make the most of modern multi-processor/multi-core architectures while at the same time providing distributed cache capabilities.  At its core Infinispan exposes a Cache interface which extends java.util.Map. It is also optionally is backed by a peer-to-peer network architecture to distribute state efficiently around a data grid.\r\n\r\nSecurity Fix(es):\r\n\r\nIt was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.(CVE-2017-15089)\r\n\r\nThe hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.(CVE-2016-0750)","status":"published","published":"2021-04-07T11:04:22Z","modified":"2026-08-18T01:15:26.232658589Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"}]}}