### [CVE-2016-0750](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0750)
![](https://img.shields.io/static/v1?label=Product&message=Infinispan&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-138&color=brighgreen)

### Description

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/PalindromeLabs/Java-Deserialization-CVEs