Vulnerability DatabaseCVE-2016-0750
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2016-0750
Published:September 11, 2018
Updated:July 21, 2026
The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.
Affected Packages
org.infinispan:infinispan-core (JAVA):
Affected version(s) >=4.0.0.ALPHA1 <9.1.0.Final
Fix Suggestion:
Update to version 9.1.0.Final
Related Resources (8)
https://access.redhat.com/errata/RHSA-2018:0501
https://access.redhat.com/errata/RHSA-2017:3244
https://github.com/infinispan/infinispan/pull/5116
http://www.securityfocus.com/bid/101910
https://issues.jboss.org/browse/ISPN-7781
https://github.com/infinispan/infinispan
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0750
https://nvd.nist.gov/vuln/detail/CVE-2016-0750
Do you need more information?
Contact Us
CVSS v4
Base Score:
2.3
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
4.2
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
Improper Neutralization of Special Elements
CWE-138
Deserialization of Untrusted Data
CWE-502
EPSS
Base Score:
2.40