Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2023-5236— Infinispan: circular reference on marshalling leads to dos

Quick assessment

Affected

Red Hat Red Hat Data Grid 8.4.4

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Red Hat Infinispan是美国红帽（Red Hat）公司的一套分布式缓存和键值NoSQL数据存储软件。 Red Hat Infinispan 存在安全漏洞，该漏洞源于在解组时不检测循环对象引用，攻击者利用该漏洞可以将恶意构造的对象插入到缓存中，并导致内存不足实现拒绝服务。

CVSS 4.4 · Medium EPSS 1.11% · P66 Updated Feb 26, 2026

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-5236

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Infinispan: circular reference on marshalling leads to dos

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Red Hat Infinispan 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Red Hat Data Grid 8.4.4	-	`cpe:/a:redhat:jboss_data_grid:8`
Red Hat	Red Hat build of Apache Camel 4 for Quarkus 3	-	`cpe:/a:redhat:camel_quarkus:3`
Red Hat	Red Hat build of Apache Camel 4 for Quarkus 3	-	`cpe:/a:redhat:camel_quarkus:3`
Red Hat	Red Hat build of Apache Camel 4 for Quarkus 3	-	`cpe:/a:redhat:camel_quarkus:3`
Red Hat	Red Hat build of Apache Camel for Spring Boot 4	-	`cpe:/a:redhat:camel_spring_boot:4`
Red Hat	Red Hat build of Apache Camel for Spring Boot 4	-	`cpe:/a:redhat:camel_spring_boot:4`
Red Hat	Red Hat build of Apache Camel for Spring Boot 4	-	`cpe:/a:redhat:camel_spring_boot:4`
Red Hat	Red Hat build of Debezium 2	-	`cpe:/a:redhat:debezium:2`
Red Hat	Red Hat build of Debezium 2	-	`cpe:/a:redhat:debezium:2`
Red Hat	Red Hat build of Debezium 2	-	`cpe:/a:redhat:debezium:2`
Red Hat	Red Hat build of Debezium 3	-	`cpe:/a:redhat:debezium:3`
Red Hat	Red Hat build of Debezium 3	-	`cpe:/a:redhat:debezium:3`
Red Hat	Red Hat build of Debezium 3	-	`cpe:/a:redhat:debezium:3`
Red Hat	Red Hat build of Quarkus	-	`cpe:/a:redhat:quarkus:3`
Red Hat	Red Hat build of Quarkus	-	`cpe:/a:redhat:quarkus:3`
Red Hat	Red Hat build of Quarkus	-	`cpe:/a:redhat:quarkus:3`
Red Hat	Red Hat Data Grid 8	-	`cpe:/a:redhat:jboss_data_grid:8`
Red Hat	Red Hat Data Grid 8	-	`cpe:/a:redhat:jboss_data_grid:8`
Red Hat	Red Hat Data Grid 8	-	`cpe:/a:redhat:jboss_data_grid:8`
Red Hat	Red Hat Data Grid 8	-	`cpe:/a:redhat:jboss_data_grid:8`
Red Hat	Red Hat Fuse 7	-	`cpe:/a:redhat:jboss_fuse:7`
Red Hat	Red Hat Fuse 7	-	`cpe:/a:redhat:jboss_fuse:7`
Red Hat	Red Hat Fuse 7	-	`cpe:/a:redhat:jboss_fuse:7`
Red Hat	Red Hat JBoss Enterprise Application Platform 7	-	`cpe:/a:redhat:jboss_enterprise_application_platform:7`
Red Hat	Red Hat JBoss Enterprise Application Platform 7	-	`cpe:/a:redhat:jboss_enterprise_application_platform:7`
Red Hat	Red Hat JBoss Enterprise Application Platform 7	-	`cpe:/a:redhat:jboss_enterprise_application_platform:7`
Red Hat	Red Hat JBoss Enterprise Application Platform 7	-	`cpe:/a:redhat:jboss_enterprise_application_platform:7`
Red Hat	Red Hat JBoss Enterprise Application Platform 8	-	`cpe:/a:redhat:jboss_enterprise_application_platform:8`
Red Hat	Red Hat JBoss Enterprise Application Platform 8	-	`cpe:/a:redhat:jboss_enterprise_application_platform:8`
Red Hat	Red Hat JBoss Enterprise Application Platform 8	-	`cpe:/a:redhat:jboss_enterprise_application_platform:8`

II. Public POCs for CVE-2023-5236

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2023-5236

请登录查看更多情报信息。

Vendor Advisories for CVE-2023-5236 (4)

🔗 NetApp Product Security Read full article
https://access.redhat.com/security/cve/CVE-2023-5236 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2240999 issue-tracking x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2023:5396 vendor-advisory x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2023-5236

Same Patch Batch · Red Hat · 2023-12-18 · 10 CVEs total

CVE-2023-4320	7.6 HIGH	Satellite: arithmetic overflow in satellite
CVE-2023-5384	7.2 HIGH	Infinispan: credentials returned from configuration as clear text
CVE-2023-5056	6.8 MEDIUM	Skupper-operator: privelege escalation via config map
CVE-2023-3628	6.5 MEDIUM	Infispan: rest bulk ops don't check permissions
CVE-2023-5115	6.3 MEDIUM	Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files
CVE-2023-6927	4.6 MEDIUM	Keycloak: open redirect via "form_post.jwt" jarm response mode
CVE-2023-3629	4.3 MEDIUM	Infinispan: non-admins should not be able to get cache config via rest api
CVE-2023-6918	3.7 LOW	Libssh: missing checks for return values for digests
CVE-2023-6228	3.3 LOW	Libtiff: heap-based buffer overflow in cpstriptotile() in tools/tiffcp.c

IV. Related Vulnerabilities

Same product: Red Hat Data Grid 8.4.4

Same vendor: Red Hat