# CVE-2024-6875: Infinispan REST API memory leak leading to Denial of Service

Source: https://junglewise.ai/threats/cve-2024-6875-infinispan-rest-api-memory-leak-leading-to-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-03-28. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2024-6875 · Severity: medium · CVSS 6.5 · Published 2025-03-28

Infinispan, a distributed data storage system used in Red Hat Data Grid, is vulnerable to a memory leak in its REST API. By sending repeated large requests to the comparison interface, an authenticated user can exhaust the server's memory. This results in a denial-of-service (DoS) condition, causing the application to crash or become unresponsive, potentially disrupting business operations and data availability.

Technologies: [Red Hat Data Grid 8](https://junglewise.ai/threats/technologies/data-grid-8), [Red Hat Infinispan](https://junglewise.ai/threats/technologies/infinispan). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2024-6875 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-6875 being exploited in the wild.

**How severe is CVE-2024-6875?** Medium severity, with a CVSS score of 6.5, published 28 March 2025.

**Which products and versions are affected?** org.infinispan:infinispan-query (Maven) ECOSYSTEM:introduced=0,last_affected=15.0.5.Final; Red Hat Data Grid 8 8.x; Red Hat Infinispan <= 15.0.5.Final, 15.1.0.Dev01; Red Hat JBoss Data Grid 7 7.x.

**Is there a fix for CVE-2024-6875?** A patch was published on 2024-07-19: Fix merged into Infinispan main and 15.0.x branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-6875 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-6875?** Check whether you run org.infinispan:infinispan-query (Maven), Red Hat Data Grid 8, Red Hat Infinispan or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the Infinispan component of Red Hat Data Grid due to a buffer leak in the REST compare API. The root cause is a failure to release Netty direct buffers (CWE-401) when processing large POST data. An attacker with network access and valid user credentials can exploit this by sending continuous requests with large payloads (e.g., 1MiB), eventually triggering an 'OutOfMemoryError: Direct buffer memory' crash. The issue is tracked under Red Hat issue JDG-7169 and Infinispan issue ISPN-16233. Fixes have been integrated into Infinispan version 15.0.6.Final and subsequent releases.

## Affected products

- Red Hat Infinispan <= 15.0.5.Final, 15.1.0.Dev01
- Red Hat Red Hat Data Grid 8 8.x
- Red Hat Red Hat JBoss Data Grid 7 7.x

## Identifiers

- CVE-2024-6875
- GHSA-2q39-w2hw-2pjm

## Timeline

- 2024-07-18: disclosed: Reported to Red Hat Bugzilla
- 2024-07-19: patched: Fix merged into Infinispan main and 15.0.x branches
- 2025-03-28: advisory: GitHub and NVD advisory published

## References

- [https://access.redhat.com/security/cve/CVE-2024-6875](https://access.redhat.com/security/cve/CVE-2024-6875)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2298555](https://bugzilla.redhat.com/show_bug.cgi?id=2298555)
- [https://github.com/infinispan/infinispan/pull/12645](https://github.com/infinispan/infinispan/pull/12645)
- [https://github.com/infinispan/infinispan/pull/12663](https://github.com/infinispan/infinispan/pull/12663)
- [https://issues.redhat.com/browse/JDG-7169](https://issues.redhat.com/browse/JDG-7169)

## Related threats

- [Infinispan Ickle query parser stack overflow in nested predicates](https://junglewise.ai/threats/cve-2026-119542-a-flaw-was-found-in-the-ickle-query-parser-in-infinispan-a-query)
- [JBoss Marshalling deserialization RCE in Infinispan session replication](https://junglewise.ai/threats/cve-2026-15555-jboss-marshalling-deserialization-rce-in-infinispan-session)
- [Red Hat Keycloak Client Policy bypass in keycloak-services](https://junglewise.ai/threats/cve-2026-16093-red-hat-keycloak-client-policy-bypass-in-keycloak-services)
- [Red Hat Keycloak authorization bypass in group search API](https://junglewise.ai/threats/cve-2026-15945-red-hat-keycloak-authorization-bypass-in-group-search-api)
- [Red Hat Undertow resource exhaustion in HTTP request parsing](https://junglewise.ai/threats/cve-2026-3260-red-hat-undertow-resource-exhaustion-in-http-request-parsing)