Skip to content
Fencer Vulns
medium 4.4

CVE-2023-5236 json

Infinispan: circular reference on marshalling leads to dos

published 2023-12-18 2 y ago modified 2026-11-07 43 h ago also EUVD-2023-3094 , GHSA-488m-w9fp-5mm2

cvss
4.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.

Patch / fix

  • maven org.infinispan.protostream:protostream 4.6.2.Final
  • infinispan protostream 4.6.2.Final
  • org.infinispan.protostream protostream 4.6.2.Final
  • redhat data_grid 8.4.4

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-5236 updated cvss 4.4

infinispan: circular reference on marshalling leads to DoS

  • Red Hat build of Apache Camel 4 for Quarkus 3 protostream, protostream-types, protostream-processor Red Hat build of Apache Camel for Spring Boot 4 protostream, protostream-types, protostream-processor Red Hat build of Debezium 2 protostream, protostream-types, protostream-processor Red Hat build of Debezium 3 protostream, protostream-types, protostream-processor Red Hat build of Quarkus protostream, protostream-types, protostream-processor Red Hat Data Grid 8 protostream, protostream-types, protostream-processor, protostream-integrationtests
    +6 more products
    Red Hat Fuse 7 protostream, protostream-types, protostream-processor Red Hat JBoss Enterprise Application Platform 7 protostream, protostream-types, protostream-processor, protostream-integrationtests Red Hat JBoss Enterprise Application Platform 8 protostream, protostream-types, protostream-processor, protostream-integrationtests Red Hat JBoss Enterprise Application Platform Expansion Pack protostream, protostream-types, protostream-processor, protostream-integrationtests Red Hat Process Automation 7 protostream Red Hat Single Sign-On 7 protostream, protostream-processor
    affected: no fix available “Fix deferred”
  • Red Hat Data Grid 8.4.4
    fixed: vendor fix RHSA-2023:5396

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.11% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven org.infinispan.protostream:protostream
<4.6.2.Final
4.6.2.Final

Affected products

  • Red Hat Red Hat Data Grid 8.4.4
  • Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat Red Hat build of Debezium 2
  • Red Hat Red Hat build of Debezium 3
  • Red Hat Red Hat build of Quarkus
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat Process Automation 7
  • Red Hat Red Hat Single Sign-On 7

Classification

Weakness
  • CWE-1047 Modules with Circular Dependencies
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Add correct affected ranges per https://github.com/advisories/GHSA-488m-w9fp-5mm2.