Live › vulnerability › CVE-2026-119542
A query with deeply nested predicates makes the Ickle query parser recurse until the Java thread stack overflows, throwing an uncaught StackOverflowError. An attacker with BULK_READ permission can use this to degrade availability.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 14:30 UTC. All times on this page are UTC.
Teams running Infinispan servers where users hold BULK_READ permission and can submit cache queries. The sources do not name affected versions. Deployments where only trusted clients can query, or where no user has BULK_READ, are less exposed.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULK_READ permission who can submit a cache query may trigger the issue, potentially affecting availability.
This page as .md · .json · in your agent: get_signal("CVE-2026-119542")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.