SZB-28820a2ffd
Infinispan Ickle query parser stack overflow (EUVD-2026-113950)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Infinispan
- Product
- Ickle query parser
- First seen
Summary
The EUVD entry reports that deeply nested predicates in Infinispan's Ickle query parser can exhaust the Java thread stack, scored 4.3 under CVSS v3.1. It says an authenticated user with BULK_READ permission can trigger the condition.
If you use Infinispan
Update Infinispan to a release that fixes the Ickle parser issue
Review which users hold BULK_READ permission and remove unnecessary grants
Monitor servers for StackOverflowError entries in logs
What the sources say 1
· Mastodon: “A flaw was found in the Ickle query parser in Infinispan.” Source