← Vulnerability feed

Vulnerability record · CVE-2016-0750 · published 11 September 2018

CVE-2016-0750: Infinispan deserialization of untrusted data vulnerability

Infinispan · Infinispan

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.

8.8 CVSS 3.0 High EPSS 2.4% · top 16.5% CWE-138 · CWE-138CWE-502 · Deserialization of untrusted data
8.8CVSS 3.0 base score, v2 6.5
2.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References
17 Jun 2026Last modified by NVD

Description

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/101910 Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:3244 Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0501 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0750 Issue TrackingVendor Advisory
https://github.com/infinispan/infinispan/pull/5116 PatchVendor Advisory
https://issues.jboss.org/browse/ISPN-7781 Issue TrackingThird Party Advisory
http://www.securityfocus.com/bid/101910 Third Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:3244 Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0501 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0750 Issue TrackingVendor Advisory
https://github.com/infinispan/infinispan/pull/5116 PatchVendor Advisory
https://issues.jboss.org/browse/ISPN-7781 Issue TrackingThird Party Advisory

Track CVE-2016-0750 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-10158Infinispan vulnerabilityA flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session inte…EPSS 2.0%8.8CVE-2019-10174Infinispan vulnerabilityA vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to in…EPSS 3.1%8.8CVE-2018-1131Infinispan deserialization of untrusted data vulnerabilityInfinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticat…EPSS 1.2%8.8CVE-2017-15089Infinispan deserialization of untrusted data vulnerabilityIt was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authentica…EPSS 2.8%6.5CVE-2023-5236Redhat data grid vulnerabilityA flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permis…EPSS 0.89%6.5CVE-2023-3628Redhat jboss data grid vulnerabilityA flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an aut…EPSS 0.80%6.5CVE-2023-3629Redhat data grid vulnerabilityA flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This iss…EPSS 0.72%6.5CVE-2020-25711Infinispan missing authorization vulnerabilityA flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When …EPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2016-0750), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.