CVE-2026-40858

camel-infinispan Remote Aggregation Repository Unsafe Deserialization Reproducer CVE-2026-40858 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-infinispan component, tracked as CVE-2026-40858. The ProtoStream-based remote aggregation repository serializes ea...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: infinispan (UTSA-2026-032351)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032351 advisory. A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: infinispan (UTSA-2026-093035)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093035 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: infinispan (UTSA-2026-093039)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093039 advisory. Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack when a...

GHSA-W67G-5RQW-F597 vulnerabilities

Vulnerabilities for packages: infinispan-operator, rancher-telemetry, amazon-cloudwatch-agent, emissary, aws-node-termination-handler, jitsucom-bulker, juicefs-csi-driver, cloudflared, kubevela, verticadb-operator, kubernetes, guac, etcd, op-geth, redis-operator...

GHSA-8C42-7QJ2-3J46 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, thingsboard, flyway, zipkin, logstash, druid, keycloak, wavefront-proxy, akhq, apicurio-registry, kserve-modelmesh, celeborn, opensearch, apache-activemq-artemis, management-api-for-apache-cassandra-5.0, trino, spark, neo4j, infinispan, tez,...

CVE-2026-59903 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, thingsboard, flyway, zipkin, logstash, druid, keycloak, wavefront-proxy, akhq, apicurio-registry, kserve-modelmesh, celeborn, opensearch, apache-activemq-artemis, management-api-for-apache-cassandra-5.0, trino, spark, neo4j, infinispan, tez,...

GHSA-QV9R-C865-CP47 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, thingsboard, spdx-tools-java, zipkin, sonarqube, keycloak-config-cli, druid, wavefront-proxy, kafka, solr, akhq, kserve-modelmesh, celeborn, opensearch, flink, apache-activemq-artemis, spark, neo4j, infinispan, apache-pulsar, wildfly, apache-t...

CVE-2026-49844 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, thingsboard, spdx-tools-java, zipkin, sonarqube, keycloak-config-cli, druid, wavefront-proxy, kafka, solr, akhq, kserve-modelmesh, celeborn, opensearch, flink, apache-activemq-artemis, spark, neo4j, infinispan, apache-pulsar, wildfly, apache-t...

jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

CVE-2026-15555

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

CVE-2026-15555

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

EUVD-2026-55982

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

CVE-2026-15555 Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

CVE-2026-15555

Technical details about CVE-2026-15555 are not publicly available in the provided documents. Monitor for updates on affected components, root cause specifics, vulnerable versions, and remediation guidance.

CVE-2026-15555 Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

CVE-2026-15555

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

PT-2026-70089

Name of the Vulnerable Software and Affected Versions JBoss marshalling affected versions not specified Description A flaw exists in the Infinispan session replication path where replicated session data is deserialized using the JBoss Marshalling River unmarshaller without class filtering. This...

CVE-2026-40984 vulnerabilities

Vulnerabilities for packages: knative-kafka-broker-fips, dependency-track, zipkin, apicurio-registry, airbyte-server-fips, ontop, infinispan, nacos, keycloak, keycloak-fips, dependency-track-apiserver, kafka-bridge, apache-nifi, ontop-fips, camunda-zeebe, apicurio-registry-fips, airbyte-server,...

GHSA-W737-WX49-QJ23 vulnerabilities

Vulnerabilities for packages: keycloak, request-9047-keycloak-fips, keycloak-fips, apicurio-registry-fips, dependency-track, apicurio-registry, airbyte-server-fips, zipkin, apache-nifi, dependency-track-apiserver, infinispan, camunda-zeebe, airbyte-server, nacos-docker, nacos...