CVEs-PoC/2016/CVE-2016-0750.md

### [CVE-2016-0750](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0750)
![](https://img.shields.io/static/v1?label=Product&message=Infinispan&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=9.1.0.Final%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-138&color=brightgreen)

### Description

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/PalindromeLabs/Java-Deserialization-CVEs