CVE-2016-0750

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.

• CWE-138
• CWE-502

• http://www.securityfocus.com/bid/101910Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2017:3244Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0501Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0750Issue Tracking, Vendor Advisory
• https://github.com/infinispan/infinispan/pull/5116Patch, Vendor Advisory
• https://issues.jboss.org/browse/ISPN-7781Issue Tracking, Third Party Advisory
• http://www.securityfocus.com/bid/101910Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2017:3244Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0501Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0750Issue Tracking, Vendor Advisory
• https://github.com/infinispan/infinispan/pull/5116Patch, Vendor Advisory
• https://issues.jboss.org/browse/ISPN-7781Issue Tracking, Third Party Advisory

Published

Sep 11, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-0743Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-0744Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-0745Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-0746Use-after-free vulnerability in the resolver in nginx 0.6.18…9.8
• CVE-2016-0747The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 d…5.3
• CVE-2016-0749The smartcard interaction in SPICE allows remote attackers t…
• CVE-2016-0751actionpack/lib/action_dispatch/http/mime_type.rb in Action P…
• CVE-2016-0752Directory traversal vulnerability in Action View in Ruby on …7.5
• CVE-2016-0753Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x b…5.3
• CVE-2016-0754cURL before 7.47.0 on Windows allows attackers to write to a…
• CVE-2016-0755The ConnectionExists function in lib/url.c in libcurl before…
• CVE-2016-0756The generate_dialback function in the mod_dialback module in…