-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.infinispan.protostream:protostream | maven | < 4.6.2.Final | 4.6.2.Final |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing recursion depth checks during Protobuf marshalling. The key commits (4501b6b, 4ef6695, 50320b5) show: 1) GeneratedMarshallerBase.writeNestedMessage lacked depth validation, 2) TagWriterImpl's nested message handling didn't track depth counters. These omissions allowed attackers to craft circular object graphs that would trigger unbounded recursion during deserialization, leading to stack overflows and OOM conditions. The CWE-1047 classification and Jira issues (IPROTO-262/263) confirm this relates to circular dependency handling in marshalling logic.