{"id":"GHSA-4hhg-8ghq-vwq6","summary":"Infinispan: Deserialization of untrusted data in the Hot Rod Java client via automatic byte-array deserialization","details":"The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.","aliases":["CVE-2016-0750"],"modified":"2026-07-10T14:56:40.111261Z","published":"2022-05-13T01:38:51Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-07-10T14:32:56Z","nvd_published_at":"2018-09-11T13:29:00Z","cwe_ids":["CWE-502"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0750"},{"type":"WEB","url":"https://github.com/infinispan/infinispan/pull/5116"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2017:3244"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2018:0501"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0750"},{"type":"PACKAGE","url":"https://github.com/infinispan/infinispan"},{"type":"WEB","url":"https://issues.jboss.org/browse/ISPN-7781"},{"type":"WEB","url":"http://www.securityfocus.com/bid/101910"}],"affected":[{"package":{"name":"org.infinispan:infinispan-core","ecosystem":"Maven","purl":"pkg:maven/org.infinispan/infinispan-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0.Final"}]}],"versions":["5.0.0.FINAL","5.0.1.FINAL","5.1.0.ALPHA1","5.1.0.ALPHA2","5.1.0.BETA1","5.1.0.BETA2","5.1.0.BETA3","5.1.0.BETA4","5.1.0.BETA5","5.1.0.CR1","5.1.0.CR2","5.1.0.CR3","5.1.0.CR4","5.1.0.FINAL","5.1.1.CR1","5.1.1.FINAL","5.1.2.CR1","5.1.2.FINAL","5.1.3.CR1","5.1.3.FINAL","5.1.4.CR1","5.1.4.FINAL","5.1.5.CR1","5.1.5.FINAL","5.1.6.FINAL","5.1.7.Final","5.1.8.Final","5.2.0.ALPHA1","5.2.0.ALPHA2","5.2.0.Alpha3","5.2.0.Alpha4","5.2.0.Beta1","5.2.0.Beta2","5.2.0.Beta3","5.2.0.Beta4","5.2.0.Beta5","5.2.0.Beta6","5.2.0.CR1","5.2.0.CR2","5.2.0.CR3","5.2.0.Final","5.2.1.Final","5.2.10.Final","5.2.11.CR1","5.2.11.Final","5.2.12.Final","5.2.13.Final","5.2.14.Final","5.2.15.Final","5.2.18.Final","5.2.19.Final","5.2.2.Final","5.2.20.Final","5.2.3.Final","5.2.4.Final","5.2.5.Final","5.2.6.Final","5.2.7-wolfc-1","5.2.7.Final","5.2.8.CR1","5.2.8.Final","5.2.9.Final","5.3.0.Alpha1","5.3.0.Beta1","5.3.0.Beta2","5.3.0.CR1","5.3.0.CR2","5.3.0.Final","6.0.0.Alpha1","6.0.0.Alpha2","6.0.0.Alpha3","6.0.0.Alpha4","6.0.0.Beta1","6.0.0.Beta2","6.0.0.CR1","6.0.0.Final","6.0.1.Final","6.0.2.Final","7.0.0.Alpha1","7.0.0.Alpha2","7.0.0.Alpha3","7.0.0.Alpha4","7.0.0.Alpha5","7.0.0.Beta1","7.0.0.Beta2","7.0.0.CR1","7.0.0.CR2","7.0.0.Final","7.0.1.Final","7.0.2.Final","7.0.3.Final","7.1.0.Alpha1","7.1.0.Beta1","7.1.0.CR1","7.1.0.CR2","7.1.0.Final","7.1.1.Final","7.2.0.Alpha1","7.2.0.Beta1","7.2.0.Beta2","7.2.0.CR1","7.2.0.Final","7.2.1.Final","7.2.2.Final","7.2.3.Final","7.2.4.Final","7.2.5.Final","8.0.0.Alpha1","8.0.0.Alpha2","8.0.0.Beta1","8.0.0.Beta2","8.0.0.Beta3","8.0.0.CR1","8.0.0.Final","8.0.1.Final","8.0.2.Final","8.1.0.Alpha1","8.1.0.Alpha2","8.1.0.Beta1","8.1.0.CR1","8.1.0.Final","8.1.1.Final","8.1.2.Final","8.1.3.Final","8.1.4.Final","8.1.5.Final","8.1.6.Final","8.1.7.Final","8.1.8.Final","8.1.9.Final","8.2.0.Beta1","8.2.0.Beta2","8.2.0.CR1","8.2.0.Final","8.2.1.Final","8.2.10.Final","8.2.11.Final","8.2.12.Final","8.2.2.Final","8.2.3.Final","8.2.4.Final","8.2.5.Final","8.2.6.Final","8.2.7.Final","8.2.8.Final","9.0.0.Alpha1","9.0.0.Alpha2","9.0.0.Alpha3","9.0.0.Alpha4","9.0.0.Beta1","9.0.0.Beta2","9.0.0.CR1","9.0.0.CR2","9.0.0.CR3","9.0.0.CR4","9.0.0.Final","9.0.1.Final","9.0.2.Final","9.0.3.Final","9.1.0.Alpha1","9.1.0.Beta1","9.1.0.CR1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-4hhg-8ghq-vwq6/GHSA-4hhg-8ghq-vwq6.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}