{"id":"CVE-2023-5236","title":"Infinispan: circular reference on marshalling leads to dos","summary":"A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause o…","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","vendor":"Red Hat","product":"infinispan-server","affected":["infinispan-server","protostream (all versions)","protostream-processor (all versions)","protostream-types (all versions)","protostream (all versions)","protostream-processor (all versions)","protostream-types (all versions)","protostream (all versions)","protostream-processor (all versions)","protostream-types (all versions)","protostream (all versions)","protostream-processor (all versions)","protostream-types (all versions)","protostream (all versions)","protostream-processor (all versions)","protostream-types (all versions)","protostream (all versions)","protostream-integrationtests (all versions)","protostream-processor (all versions)","protostream-types (all versions)","protostream (all versions)","protostream-processor (all versions)","protostream-types (all versions)","protostream (all versions)","protostream-integrationtests (all versions)","protostream-processor (all versions)","protostream-types (all versions)","protostream (all versions)","protostream-integrationtests (all versions)","protostream-processor (all versions)","protostream-types (all versions)","protostream (all versions)","protostream-integrationtests (all versions)","protostream-processor (all versions)","protostream-types (all versions)","protostream (all versions)","protostream (all versions)","protostream-processor (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-08-27T15:51:30.945664Z"},"published":"2023-12-18","updated":"2026-11-07","sourceUpdated":"2026-11-07T13:41:49.221Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-5236","references":[{"url":"https://access.redhat.com/errata/RHSA-2023:5396","label":"RHSA-2023:5396"},{"url":"https://access.redhat.com/security/cve/CVE-2023-5236"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2240999","label":"RHBZ#2240999"}],"tags":["cve.org"],"epss":0.01108,"epssPercentile":0.6607,"ingestedAt":"2026-11-07T14:18:21.465Z","slug":"CVE-2023-5236","body":"## Overview\n\nA flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.\n\n## Affected\n\n- `infinispan-server`\n- `protostream (all versions)`\n- `protostream-processor (all versions)`\n- `protostream-types (all versions)`\n- `protostream (all versions)`\n- `protostream-processor (all versions)`\n- `protostream-types (all versions)`\n- `protostream (all versions)`\n- `protostream-processor (all versions)`\n- `protostream-types (all versions)`\n- `protostream (all versions)`\n- `protostream-processor (all versions)`\n- `protostream-types (all versions)`\n- `protostream (all versions)`\n- `protostream-processor (all versions)`\n- `protostream-types (all versions)`\n- `protostream (all versions)`\n- `protostream-integrationtests (all versions)`\n- `protostream-processor (all versions)`\n- `protostream-types (all versions)`\n- `protostream (all versions)`\n- `protostream-processor (all versions)`\n- `protostream-types (all versions)`\n- `protostream (all versions)`\n- `protostream-integrationtests (all versions)`\n- `protostream-processor (all versions)`\n- `protostream-types (all versions)`\n- `protostream (all versions)`\n- `protostream-integrationtests (all versions)`\n- `protostream-processor (all versions)`\n- `protostream-types (all versions)`\n- `protostream (all versions)`\n- `protostream-integrationtests (all versions)`\n- `protostream-processor (all versions)`\n- `protostream-types (all versions)`\n- `protostream (all versions)`\n- `protostream (all versions)`\n- `protostream-processor (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":24.2,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}