Vulnerability · Published Mar 28, 2025 · Assigned by redhat
CVE-2024-6875Infinispan: infinispan: rest compare api has buffer leak
Medium 6.5
In plain English
A medium-severity memory leak in infinispan. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 57.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in the Infinispan component in Red Hat Data Grid. The REST compare API may have a buffer leak and an out of memory error can occur when sending continual requests with large POST data to the REST API.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.infinispan:infinispan-query | no fix listed | GHSA-2q39-w2hw-2pjm |
| Maven | org.infinispan:infinispan-query | no fix listed | GHSA-2q39-w2hw-2pjm |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| infinispan | 0 – before 15.0.6 | |
| Red Hat | Red Hat Data Grid 8 | see references |
| Red Hat | Red Hat JBoss Data Grid 7 | see references |
Weakness: CWE-401 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://access.redhat.com/security/cve/CVE-2024-6875 vdb-entry, x_refsource_REDHAT
- RHBZ#2298555 issue-tracking, x_refsource_REDHAT
- https://github.com/infinispan/infinispan/pull/12645
- https://github.com/infinispan/infinispan/pull/12663
- https://issues.redhat.com/browse/JDG-7169