---
id: CVE-2026-119542
title: >-
  Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can
  trigger a stackoverflowerror
summary: >-
  A flaw was found in the Ickle query parser in Infinispan. A query containing
  deeply nested predicates can cause recursive parsing to exhaust the Java
  thread stack and throw an uncaught StackOverflowError. An authenticated user
  with BULK_…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-674
vendor: Red Hat
product: infinispan-query
affected:
  - infinispan-query (all versions)
  - infinispan-query (all versions)
  - infinispan-query
  - infinispan-query (all versions)
  - infinispan-query (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T15:21:17.701033Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:53:22.097Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119542'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-119542'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2563902'
    label: RHBZ#2563902
tags:
  - cve.org
epss: 0.00332
epssPercentile: 0.26549
ingestedAt: '2026-11-05T16:07:30.513Z'
---

## Overview

A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULK_READ permission who can submit a cache query may trigger the issue, potentially affecting availability.

## Affected

- `infinispan-query (all versions)`
- `infinispan-query (all versions)`
- `infinispan-query`
- `infinispan-query (all versions)`
- `infinispan-query (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.