---
id: "CVE-2026-119542"
kind: "vulnerability"
aliases: ["CVE-2026-119542"]
title: "Infinispan: deeply nested query crashes server with stack overflow"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["infinispan", "java", "package", "self-hosted"]
not_affected_if: ["no-bulk-read-users", "no-query-access"]
published_at: "2026-10-30T14:16:45+00:00"
first_seen_at: "2026-10-30T14:30:53+00:00"
updated_at: "2026-10-30T14:33:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119542", "first_seen_at": "2026-10-30T14:30:53+00:00"}]
---

# Infinispan: deeply nested query crashes server with stack overflow

A query with deeply nested predicates makes the Ickle query parser recurse until the Java thread stack overflows, throwing an uncaught StackOverflowError. An attacker with BULK_READ permission can use this to degrade availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-30T14:30:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119542

## From the sources

A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULK_READ permission who can submit a cache query may trigger the issue, potentially affecting availability.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_