CVE-2026-119542 in Infinispan
Summary
by MITRE • 10/30/2026
A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULK_READ permission who can submit a cache query may trigger the issue, potentially affecting availability.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Infinispan affects the Ickle query parser, which is responsible for processing structured queries against cached data. This component handles complex logical expressions involving multiple predicates and nested conditions. The core technical flaw lies in the recursive parsing mechanism used to evaluate deeply nested predicate structures within a single query string. When an attacker constructs a query with excessive levels of nesting, such as numerous layers of AND or OR operations combined with sub-queries or function calls that trigger further internal recursion, the Java Virtual Machine's thread stack becomes exhausted. This exhaustion results in a StackOverflowError being thrown during the parsing phase before any data retrieval occurs.
From an operational perspective, this flaw primarily impacts the availability of the Infinispan cluster nodes processing these malicious queries. Because the error is uncaught and propagates up the call stack, it typically causes the thread handling the request to terminate abruptly. In a high-concurrency environment where multiple threads are dedicated to query processing, repeated exploitation can lead to thread pool exhaustion or service degradation for legitimate users attempting to access cached data. The vulnerability does not directly compromise confidentiality or integrity of the stored data but severely disrupts service continuity by rendering specific nodes unresponsive or causing them to crash depending on how the application handles the exception at a higher level.
The attack vector requires an authenticated user possessing BULK_READ permissions, which limits the scope of potential attackers to those who have already gained some level of access to the system. This classification aligns with CWE-787: Out-of-bounds Write in terms of resource consumption leading to denial of service, although more specifically it maps to CWE-675: Operations on Data with Unminimized or Uncontrolled Resource Consumption. The exploitation technique involves crafting a specially designed query payload that exploits the recursive nature of the parser logic without triggering immediate input validation checks for depth limits.
In terms of threat modeling and adversary behavior, this vulnerability corresponds to ATT&CK tactic TA0004: Impact, specifically under techniques related to Denial of Service such as T1499: Endpoint Denial of Service or more broadly resource exhaustion attacks. An attacker would leverage their existing authenticated session to submit the malformed query via standard API endpoints that accept Ickle queries. The lack of depth limiting in the parser allows for a low-effort, high-impact attack that can be automated to sustain pressure on the target infrastructure.
Mitigation strategies should focus on implementing strict limits on query complexity and nesting depth within the application layer or through configuration updates if available in newer versions of Infinispan. Administrators should ensure they are running patched versions where this recursive parsing issue has been addressed by introducing iterative parsing mechanisms or explicit stack depth checks. Additionally, enforcing least-privilege principles for user accounts with BULK_READ permissions can reduce the attack surface. Network-level controls such as rate limiting on query submission endpoints may also help mitigate the impact of automated exploitation attempts while longer-term fixes are deployed. Regular security audits and static code analysis tools configured to detect potential stack overflow risks in recursive functions should be integrated into the development lifecycle to prevent similar issues in future releases.