CVE-2023-5236

Published: Dec 18, 2023

Modified: Nov 21, 2025

PUBLISHED

CVSS v3.1

4.4

MEDIUM

Description

A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.

Vendor	Product	Versions
Red Hat	Red Hat Data Grid 8.4.4	All versions
Red Hat	Red Hat build of Apache Camel 4 for Quarkus 3	All versions
Red Hat	Red Hat build of Apache Camel 4 for Quarkus 3	All versions
Red Hat	Red Hat build of Apache Camel 4 for Quarkus 3	All versions
Red Hat	Red Hat build of Apache Camel for Spring Boot 4	All versions
Red Hat	Red Hat build of Apache Camel for Spring Boot 4	All versions
Red Hat	Red Hat build of Apache Camel for Spring Boot 4	All versions
Red Hat	Red Hat build of Debezium 2	All versions
Red Hat	Red Hat build of Debezium 2	All versions
Red Hat	Red Hat build of Debezium 2	All versions
Red Hat	Red Hat build of Debezium 3	All versions
Red Hat	Red Hat build of Debezium 3	All versions
Red Hat	Red Hat build of Debezium 3	All versions
Red Hat	Red Hat build of Quarkus	All versions
Red Hat	Red Hat build of Quarkus	All versions
Red Hat	Red Hat build of Quarkus	All versions
Red Hat	Red Hat Data Grid 8	All versions
Red Hat	Red Hat Data Grid 8	All versions
Red Hat	Red Hat Data Grid 8	All versions
Red Hat	Red Hat Data Grid 8	All versions
Red Hat	Red Hat Fuse 7	All versions
Red Hat	Red Hat Fuse 7	All versions
Red Hat	Red Hat Fuse 7	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform 7	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform 7	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform 7	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform 7	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform 8	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform 8	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform 8	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform 8	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	All versions
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	All versions
Red Hat	Red Hat Process Automation 7	All versions
Red Hat	Red Hat Single Sign-On 7	All versions
Red Hat	Red Hat Single Sign-On 7	All versions

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

References

RHSA-2023:5396

vendor-advisory

x_refsource_REDHAT

https://access.redhat.com/security/cve/CVE-2023-5236

vdb-entry

x_refsource_REDHAT

RHBZ#2240999

issue-tracking

x_refsource_REDHAT

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2023-5236

Description

Affected Products

CVSS v3.1 Details

References