CVE-2016-0750

8.8 highEPSS 2.4%

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.4% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
CWEs: CWE-502, CWE-138
Published: 2018-09-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

infinispan:infinispan

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-4hhg-8ghq-vwq6	Maven	org.infinispan:infinispan-core	<9.1.0.Final	9.1.0.Final

References

http://www.securityfocus.com/bid/101910
https://access.redhat.com/errata/RHSA-2017:3244
https://access.redhat.com/errata/RHSA-2018:0501
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0750
https://github.com/infinispan/infinispan/pull/5116

Check your stack JSON