Executive brief
Infinispan, a distributed data storage system used in Red Hat Data Grid, is vulnerable to a memory leak in its REST API. By sending repeated large requests to the comparison interface, an authenticated user can exhaust the server's memory. This results in a denial-of-service (DoS) condition, causing the application to crash or become unresponsive, potentially disrupting business operations and data availability.
Technical details
A vulnerability exists in the Infinispan component of Red Hat Data Grid due to a buffer leak in the REST compare API. The root cause is a failure to release Netty direct buffers (CWE-401) when processing large POST data. An attacker with network access and valid user credentials can exploit this by sending continuous requests with large payloads (e.g., 1MiB), eventually triggering an 'OutOfMemoryError: Direct buffer memory' crash. The issue is tracked under Red Hat issue JDG-7169 and Infinispan issue ISPN-16233. Fixes have been integrated into Infinispan version 15.0.6.Final and subsequent releases.
Affected products
- Red Hat Infinispan <= 15.0.5.Final, 15.1.0.Dev01
- Red Hat Red Hat Data Grid 8 8.x
- Red Hat Red Hat JBoss Data Grid 7 7.x
Timeline
- 2024-07-18: disclosed: Reported to Red Hat Bugzilla
- 2024-07-19: patched: Fix merged into Infinispan main and 15.0.x branches
- 2025-03-28: advisory: GitHub and NVD advisory published