Medium severity4.4NVD Advisory· Published Dec 18, 2023· Updated Jun 17, 2026
CVE-2023-5236
CVE-2023-5236
Description
A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.infinispan.protostream:protostreamMaven | < 4.6.2.Final | 4.6.2.Final |
Affected products
28- Red Hat/Red Hat build of Apache Camel 4 for Quarkus 3v5cpe:/a:redhat:camel_quarkus:3
- Red Hat/Red Hat build of Debezium 2v5cpe:/a:redhat:debezium:2
- Red Hat/Red Hat build of Debezium 3v5cpe:/a:redhat:debezium:3
- Red Hat/Red Hat build of Quarkusv5cpe:/a:redhat:quarkus:3
- Red Hat/Red Hat Data Grid 8v5cpe:/a:redhat:jboss_data_grid:8
- Red Hat/Red Hat Fuse 7v5cpe:/a:redhat:jboss_fuse:7
- ghsa-coords13 versionspkg:maven/org.infinispan.protostream/protostreampkg:apk/chainguard/infinispan-15.0-compatpkg:apk/chainguard/infinispan-15.0-imagespkg:apk/chainguard/infinispan-15.1pkg:apk/chainguard/infinispan-15.2pkg:apk/wolfi/infinispan-15.2-imagespkg:apk/chainguard/infinispan-15.2-compatpkg:apk/chainguard/infinispan-15.0pkg:apk/chainguard/infinispan-15.1-compatpkg:apk/chainguard/infinispan-15.1-imagespkg:apk/chainguard/infinispan-15.2-imagespkg:apk/wolfi/infinispan-15.2pkg:apk/wolfi/infinispan-15.2-compat
< 4.6.2.Final+ 12 more
- (no CPE)range: < 4.6.2.Final
- (no CPE)range: < 15.0.21-r1
- (no CPE)range: < 15.0.21-r1
- (no CPE)range: < 15.1.7-r3
- (no CPE)range: < 15.2.6-r1
- (no CPE)range: < 15.2.6-r1
- (no CPE)range: < 15.2.6-r1
- (no CPE)range: < 15.0.21-r1
- (no CPE)range: < 15.1.7-r3
- (no CPE)range: < 15.1.7-r3
- (no CPE)range: < 15.2.6-r1
- (no CPE)range: < 15.2.6-r1
- (no CPE)range: < 15.2.6-r1
- cpe:/a:redhat:camel_spring_boot:4
cpe:/a:redhat:jboss_enterprise_application_platform:7+ 1 more
- cpe:/a:redhat:jboss_enterprise_application_platform:7
- cpe:/a:redhat:jboss_enterprise_application_platform:8
- cpe:/a:redhat:jbosseapxp
- cpe:/a:redhat:jboss_enterprise_bpms_platform:7
- cpe:/a:redhat:red_hat_single_sign_on:7
- cpe:2.3:a:infinispan:infinispan:-:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
13- access.redhat.com/errata/RHSA-2023:5396nvdVendor AdvisoryWEB
- access.redhat.com/security/cve/CVE-2023-5236nvdVendor AdvisoryWEB
- github.com/advisories/GHSA-488m-w9fp-5mm2ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-5236ghsaADVISORY
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingWEB
- github.com/infinispan/protostream/commit/4501b6b307a6bab545346f66238f8be7e42f83ebghsaWEB
- github.com/infinispan/protostream/commit/4ef66958f2c4890ae1c6a7acd629d27bd88aa4cbghsaWEB
- github.com/infinispan/protostream/commit/50320b5987dc87bc04b616b87e8cf93472ee19c1ghsaWEB
- issues.redhat.com/browse/IPROTO-262ghsaWEB
- issues.redhat.com/browse/IPROTO-263ghsaWEB
- issues.redhat.com/browse/ISPN-14534ghsaWEB
- security.netapp.com/advisory/ntap-20240125-0004ghsaWEB
- security.netapp.com/advisory/ntap-20240125-0004/nvd
News mentions
0No linked articles in our index yet.