Infinispan

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Infinispan product.

RSS Feeds for Infinispan security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Infinispan products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Infinispan Sorted by Most Security Vulnerabilities since 2018

Infinispan11 vulnerabilities

Infinispan Server Rest2 vulnerabilities

Infinispan Hot Rod1 vulnerability

Infinispan Server Runtime1 vulnerability

By the Year

In 2026 there have been 0 vulnerabilities in Infinispan. Infinispan did not have any published security vulnerabilities last year.

Year	Vulnerabilities	Average Score
2026	0	0.00
2025	0	0.00
2024	0	0.00
2023	5	5.96
2022	0	0.00
2021	2	8.45
2020	3	7.47
2019	1	8.80
2018	1	8.80

It may take a day or so for new Infinispan vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Infinispan Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2023-5384	Dec 18, 2023	Infinispan Config Serialization leaks credentials as cleartext A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.	Infinispan
CVE-2023-5236	Dec 18, 2023	Java: Infinispan Unmarshal OOM DoS from Circular Object Ref A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.	Infinispan
CVE-2023-3629	Dec 18, 2023	Infinispan REST Cache Retrieval Permission Bypass A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.	Infinispan
CVE-2023-3628	Dec 18, 2023	Infinispan REST Bulk Read Auth Bypass A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.	Infinispan
CVE-2023-4586	Oct 04, 2023	TLS Hostname Validation Missing in Apache Ignite Hot Rod Client (MITM Risk) A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack.	Hot Rod
CVE-2021-31917	Sep 21, 2021	A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0) A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all REST endpoints when DIGEST is used as the authentication method. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Infinispan Infinispan Server Rest
CVE-2020-10771	Jun 02, 2021	A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an attacker to perform a cross-site request forgery (CSRF) attack.	Infinispan Infinispan Server Rest
CVE-2020-25711	Dec 03, 2020	A flaw was found in infinispan 10 REST API A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.	Infinispan
CVE-2020-10746	Oct 19, 2020	A flaw was found in Infinispan (org.infinispan:infinispan-server-runtime) version 10, where it permits local access to controls A flaw was found in Infinispan (org.infinispan:infinispan-server-runtime) version 10, where it permits local access to controls via both REST and HotRod APIs. This flaw allows a user authenticated to the local machine to perform all operations on the caches, including the creation, update, deletion, and shutdown of the entire server.	Infinispan Infinispan Server Runtime
CVE-2019-10158	Jan 02, 2020	A flaw was found in Infinispan through version 9.4.14.Final A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.	Infinispan