CVE-2024-6875: Infinispan REST API memory leak leading to Denial of Service

CVE-2024-6875 · Severity: medium · CVSS 6.5 · Published 2025-03-28

Infinispan, a distributed data storage system used in Red Hat Data Grid, is vulnerable to a memory leak in its REST API. By sending repeated large requests to the comparison interface, an authenticated user can exhaust the server's memory. This results in a denial-of-service (DoS) condition, causing the application to crash or become unresponsive, potentially disrupting business operations and data availability.

Technologies: Red Hat Data Grid 8, Red Hat Infinispan. Vendors: Maven, Red Hat.

Quick answers

Is CVE-2024-6875 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-6875 being exploited in the wild.
How severe is CVE-2024-6875?
Medium severity, with a CVSS score of 6.5, published 28 March 2025.
Which products and versions are affected?
org.infinispan:infinispan-query (Maven) ECOSYSTEM:introduced=0,last_affected=15.0.5.Final; Red Hat Data Grid 8 8.x; Red Hat Infinispan <= 15.0.5.Final, 15.1.0.Dev01; Red Hat JBoss Data Grid 7 7.x.
Is there a fix for CVE-2024-6875?
A patch was published on 2024-07-19: Fix merged into Infinispan main and 15.0.x branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-6875 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-6875?
Check whether you run org.infinispan:infinispan-query (Maven), Red Hat Data Grid 8, Red Hat Infinispan or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the Infinispan component of Red Hat Data Grid due to a buffer leak in the REST compare API. The root cause is a failure to release Netty direct buffers (CWE-401) when processing large POST data. An attacker with network access and valid user credentials can exploit this by sending continuous requests with large payloads (e.g., 1MiB), eventually triggering an 'OutOfMemoryError: Direct buffer memory' crash. The issue is tracked under Red Hat issue JDG-7169 and Infinispan issue ISPN-16233. Fixes have been integrated into Infinispan version 15.0.6.Final and subsequent releases.

Affected products

  • Red Hat Infinispan <= 15.0.5.Final, 15.1.0.Dev01
  • Red Hat Red Hat Data Grid 8 8.x
  • Red Hat Red Hat JBoss Data Grid 7 7.x

Identifiers

  • CVE-2024-6875
  • GHSA-2q39-w2hw-2pjm

Timeline

  • 2024-07-18: disclosed: Reported to Red Hat Bugzilla
  • 2024-07-19: patched: Fix merged into Infinispan main and 15.0.x branches
  • 2025-03-28: advisory: GitHub and NVD advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.