Infinispan EUVD-2026-113950

Exploitation requires an authenticated account that holds the BULK_READ permission and the ability to submit an Ickle cache query to Infinispan / Red Hat Data Grid; the attacker must supply a query with deeply nested predicates to drive recursive parsing into stack exhaustion. Limiting factors: valid authentication plus the specific BULK_READ grant are mandatory (not available to anonymous or unprivileged users), and the impact is confined to availability with no data exposure or modification. The sources do not state how many nesting levels are needed or whether the error affects a single request, the node, or the cluster, so the severity of the resulting outage is unverified.

This is a genuinely low-to-moderate priority issue, consistent with its CVSS 4.3 (Medium) rating, not a high-severity emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L shows network reach and low attack complexity but requires low-level authentication (PR:L) and yields only limited availability impact (A:L) with no confidentiality or integrity loss - matching the description, which requires an authenticated user holding the BULK_READ permission who can submit cache queries. No EPSS score, KEV listing, or PoC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_month', indicating routine scheduled remediation rather than urgent action. The practical ceiling is a single uncaught StackOverflowError affecting availability; the description does not state whether this crashes a thread, a node, or the whole service, so the true blast radius is unverified. Overall this is a real but modest denial-of-service hardening issue gated behind both authentication and a specific permission, not a drop-everything priority.

An attacker who already holds a low-privilege account with the BULK_READ permission on a Data Grid / Infinispan deployment crafts an Ickle query containing deeply nested predicates and submits it. The recursive query parser consumes the Java thread stack and throws an uncaught StackOverflowError, degrading availability for that query path. No public PoC or exploit code is referenced in the available sources.