CVE-2026-119542
Awaiting Analysis Awaiting Analysis - Queue

Stack Overflow Error in Infinispan Ickle Query Parser

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: redhat-SADP

Description
A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULK_READ permission who can submit a cache query may trigger the issue, potentially affecting availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119542
EUVD
EUVD-2026-113950

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a flaw in the Ickle query parser used by Infinispan. It occurs when a query contains deeply nested predicates, causing recursive parsing that exhausts the Java thread stack and results in a StackOverflowError. This can lead to an uncaught exception affecting system availability.

Impact Analysis

An authenticated user with BULK_READ permission could submit a malicious cache query to trigger this issue. The primary impact is reduced system availability due to thread stack exhaustion, potentially causing service disruption or downtime.

Mitigation Strategies

Restrict BULK_READ permissions to trusted users only and avoid submitting deeply nested queries in Infinispan caches to prevent stack overflow errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119542. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart