CVE-2023-5236: 
Java vulnerability analysis and mitigation

A vulnerability (CVE-2023-5236) was discovered in Infinispan, affecting its object unmarshalling process. The vulnerability was disclosed on December 18, 2023, and affects Infinispan and Red Hat Data Grid products. The flaw exists in the system's inability to detect circular object references during the unmarshalling process (NVD, Red Hat CVE).

The vulnerability is characterized by a failure to detect circular object references during the unmarshalling process in Infinispan. The CVSS v3.1 base score is rated at 6.5 (MEDIUM) with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating a network-accessible vulnerability requiring low attack complexity and low privileges, with no user interaction needed. The vulnerability primarily affects the availability of the system (NVD, NetApp Advisory).

When exploited, the vulnerability can lead to denial of service (DoS) through out-of-memory errors. Specifically, sending data containing circular object references to RHDG configured with Protostream serialization can cause it to enter an infinite loop until it exhausts the thread stack (Red Hat Bugzilla).

The vulnerability has been addressed in Red Hat Data Grid 8.4.4 through the security advisory RHSA-2023:5396. Users are advised to upgrade to this version to mitigate the vulnerability (Red Hat Advisory).