CVE-2016-0750: Infinispan: Deserialization of untrusted data in the Hot Rod Java client via automatic byte-array deserialization

May 13, 2022 (updated July 10, 2026)

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.

References

access.redhat.com/errata/RHSA-2017:3244
access.redhat.com/errata/RHSA-2018:0501
bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0750
github.com/advisories/GHSA-4hhg-8ghq-vwq6
github.com/infinispan/infinispan/pull/5116
issues.jboss.org/browse/ISPN-7781
nvd.nist.gov/vuln/detail/CVE-2016-0750

Code Behaviors & Features

Detect and mitigate CVE-2016-0750 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →