CVE-2026-119542

Overview

Infinispan is an open-source in-memory data grid and distributed key/value data store. Java applications embed it as a local or clustered cache through infinispan-core, or connect to a cluster of Infinispan Server nodes through the Java Hot Rod client, infinispan-client-hotrod. Its modules are published to Maven Central under org.infinispan, and Spring Boot 2.7 manages the Infinispan 13.0 BOM.

A denial of service vulnerability (CVE-2026-119542) has been identified in the Ickle query parser of Infinispan, which allows an authenticated user who can run a cache query to exhaust the Java thread stack with a deeply nested query, causing an uncaught StackOverflowError. On a secured cache, any user with the BULK_READ permission can send such a query.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed.

This issue affects Infinispan versions 9.0.0.Final and greater.

Details

Module Info

• Product: Infinispan
• Affected packages: org.infinispan:infinispan-query
• Affected versions: >=9.0.0.Final
• GitHub repository: https://github.com/infinispan/infinispan
• Published packages: https://central.sonatype.com/artifact/org.infinispan/infinispan-query
• Package manager: Maven
• Fixed in:
  • NES for Infinispan v13.0.24

Vulnerability Info

This Medium-severity vulnerability is found in the org.infinispan:infinispan-query package in Infinispan versions 9.0.0.Final and greater. In Infinispan 13.0, Ickle queries, whether sent through the embedded Search.getQueryFactory(cache) API or by a Hot Rod client to an Infinispan Server, are parsed by an ANTLR 3 recursive-descent parser generated from IckleParser.g in infinispan-objectfilter, which infinispan-query depends on. Each grammar rule becomes a Java method, and several rules call themselves again, directly or through other rules, once for every level of nesting in the query:

expression
	:	logicalOrExpression
	;

negatedExpression
   :  not_key^ negatedExpression
   |  equalityExpression
   ;

atom
   :  identPrimary -> ^(PATH identPrimary)
   |  constant
   |  parameterSpecification
   |  LPAREN! expressionOrVector RPAREN!
   ;

A parenthesized predicate goes from atom back into expressionOrVector and expression, a NOT goes from negatedExpression back into itself, and function calls, index expressions, aggregate functions such as sum(sum(...)) and full-text groups recurse the same way. None of these rules counts how deep it has gone, and the parser places no limit on the length of AND and OR chains, which later stages of query processing walk recursively. Every level adds several stack frames, so a short query is enough to use up the thread's stack. On a 1 MB thread stack, about 250 nested parentheses (a query of roughly 550 characters) overflow the parser in Infinispan 13.0.22.Final, as do about 230 levels of NOT (, about 250 nested function calls, and an AND chain of about 4,000 operators.

The result is a StackOverflowError thrown on the thread that handles the query. The error is not a RecognitionException, so the parser's own error handling does not catch it, and the query fails with the overflow instead of a parsing error. A user who can run queries can send such a query as often as they like.

Steps to Reproduce

• Create an embedded cache that stores com.example.Person entities.
• Run a query whose WHERE clause nests a predicate in a few hundred pairs of parentheses:

QueryFactory queryFactory = Search.getQueryFactory(cache);
int depth = 300;
String query = "FROM com.example.Person p WHERE "
      + "(".repeat(depth) + "p.name = 'x'" + ")".repeat(depth);
queryFactory.create(query).execute().list();

• Run the code on a thread with a 1 MB stack, the JVM default for new threads on Linux x64, and observe that the call throws java.lang.StackOverflowError from the Ickle parser.

Mitigation

Infinispan's security policy lists only its current release lines as supported for vulnerability updates, and upstream has made no 13.0.x release since 13.0.22.Final (April 2024), so no 13.0.x release is available to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of Infinispan that contains the fix, once upstream publishes one. No upstream release addresses this issue yet.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Liu Chunyan from Fudan University (finder)