CVE-2016-0750: Infinispan: Deserialization of untrusted data in the Hot Rod Java client via automatic byte-array deserialization

May 13, 2022 (updated July 10, 2026)

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.

References

access.redhat.com/errata/RHSA-2017:3244
access.redhat.com/errata/RHSA-2018:0501
bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0750
github.com/advisories/GHSA-4hhg-8ghq-vwq6
github.com/infinispan/infinispan/pull/5116
issues.jboss.org/browse/ISPN-7781
nvd.nist.gov/vuln/detail/CVE-2016-0750

Code Behaviors & Features

Detect and mitigate CVE-2016-0750 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →