Infinispan
13 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Infinispan, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.
Infinispan CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 1 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 1 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 13 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High4
- Medium8
Latest CVEs
The 13 most recently published vulnerabilities affecting Infinispan.
- CVE-2025-5731Infinispan: credential leakage in infinispan cli5.5
- CVE-2025-0736Org.infinispan-infinispan-parent: exposure of sensitive information in application logs5.5
- CVE-2023-5236Infinispan: circular reference on marshalling leads to dos4.4
- CVE-2023-5384Infinispan: credentials returned from configuration as clear text7.2
- CVE-2023-3628Infispan: rest bulk ops don't check permissions6.5
- CVE-2023-3629Infinispan: non-admins should not be able to get cache config via rest api4.3
- CVE-2020-25711A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication c...6.5
- CVE-2019-10158A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.9.8
- CVE-2019-10174A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispa...8.8
- CVE-2016-0750The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-cr...4.2
- CVE-2017-2638It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or ...6.5
- CVE-2018-1131Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious o...8.8
- CVE-2017-15089It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object int...8.8
Product grouping is registry-driven, with AI assist and human review. How it works