Vulnerability-Lookup

CVE-2026-11312 (GCVE-0-2026-11312)

Vulnerability from cvelistv5 – Published: 2026-06-05 00:30 – Updated: 2026-06-05 13:12

Title

bytedance InfiniStore KV Map infinistore.h purge_kv_map algorithmic complexity

Summary

A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R

3.3 (Low)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-407 - Inefficient Algorithmic Complexity
CWE-404 - Denial of Service

Assigner

VulDB

References

6 references

URL	Tags
https://vuldb.com/vuln/368398	vdb-entrytechnical-description
https://vuldb.com/vuln/368398/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-11312	third-party-advisory
https://vuldb.com/submit/832348	third-party-advisory
https://github.com/bytedance/InfiniStore/issues/200	exploitissue-tracking
https://github.com/bytedance/InfiniStore/	product

Impacted products

1 product

Vendor	Product	Version
bytedance	InfiniStore	Affected: 0.2.0 Affected: 0.2.1 Affected: 0.2.2 Affected: 0.2.3 Affected: 0.2.4 Affected: 0.2.5 Affected: 0.2.6 Affected: 0.2.7 Affected: 0.2.8 Affected: 0.2.9 Affected: 0.2.10 Affected: 0.2.11 Affected: 0.2.12 Affected: 0.2.13 Affected: 0.2.14 Affected: 0.2.15 Affected: 0.2.16 Affected: 0.2.17 Affected: 0.2.18 Affected: 0.2.19 Affected: 0.2.20 Affected: 0.2.21 Affected: 0.2.22 Affected: 0.2.23 Affected: 0.2.24 Affected: 0.2.25 Affected: 0.2.26 Affected: 0.2.27 Affected: 0.2.28 Affected: 0.2.29 Affected: 0.2.30 Affected: 0.2.31 Affected: 0.2.32 Affected: 0.2.33 cpe:2.3:a:bytedance:infinistore::::::::

Credits

Dem00 (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11312",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-05T13:12:38.127231Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-05T13:12:50.570Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:bytedance:infinistore:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "KV Map Handler"
          ],
          "product": "InfiniStore",
          "vendor": "bytedance",
          "versions": [
            {
              "status": "affected",
              "version": "0.2.0"
            },
            {
              "status": "affected",
              "version": "0.2.1"
            },
            {
              "status": "affected",
              "version": "0.2.2"
            },
            {
              "status": "affected",
              "version": "0.2.3"
            },
            {
              "status": "affected",
              "version": "0.2.4"
            },
            {
              "status": "affected",
              "version": "0.2.5"
            },
            {
              "status": "affected",
              "version": "0.2.6"
            },
            {
              "status": "affected",
              "version": "0.2.7"
            },
            {
              "status": "affected",
              "version": "0.2.8"
            },
            {
              "status": "affected",
              "version": "0.2.9"
            },
            {
              "status": "affected",
              "version": "0.2.10"
            },
            {
              "status": "affected",
              "version": "0.2.11"
            },
            {
              "status": "affected",
              "version": "0.2.12"
            },
            {
              "status": "affected",
              "version": "0.2.13"
            },
            {
              "status": "affected",
              "version": "0.2.14"
            },
            {
              "status": "affected",
              "version": "0.2.15"
            },
            {
              "status": "affected",
              "version": "0.2.16"
            },
            {
              "status": "affected",
              "version": "0.2.17"
            },
            {
              "status": "affected",
              "version": "0.2.18"
            },
            {
              "status": "affected",
              "version": "0.2.19"
            },
            {
              "status": "affected",
              "version": "0.2.20"
            },
            {
              "status": "affected",
              "version": "0.2.21"
            },
            {
              "status": "affected",
              "version": "0.2.22"
            },
            {
              "status": "affected",
              "version": "0.2.23"
            },
            {
              "status": "affected",
              "version": "0.2.24"
            },
            {
              "status": "affected",
              "version": "0.2.25"
            },
            {
              "status": "affected",
              "version": "0.2.26"
            },
            {
              "status": "affected",
              "version": "0.2.27"
            },
            {
              "status": "affected",
              "version": "0.2.28"
            },
            {
              "status": "affected",
              "version": "0.2.29"
            },
            {
              "status": "affected",
              "version": "0.2.30"
            },
            {
              "status": "affected",
              "version": "0.2.31"
            },
            {
              "status": "affected",
              "version": "0.2.32"
            },
            {
              "status": "affected",
              "version": "0.2.33"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Dem00 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1.7,
            "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-404",
              "description": "Denial of Service",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-05T00:30:14.091Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-368398 | bytedance InfiniStore KV Map infinistore.h purge_kv_map algorithmic complexity",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/368398"
        },
        {
          "name": "VDB-368398 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/368398/cti"
        },
        {
          "name": "CVE-2026-11312 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-11312"
        },
        {
          "name": "Submit #832348 | bytedance InfiniStore 0.2.33 Denial of Service",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/832348"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/bytedance/InfiniStore/issues/200"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/bytedance/InfiniStore/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-04T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-06-04T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-06-04T20:15:15.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "bytedance InfiniStore KV Map infinistore.h purge_kv_map algorithmic complexity"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-11312",
    "datePublished": "2026-06-05T00:30:14.091Z",
    "dateReserved": "2026-06-04T18:10:12.303Z",
    "dateUpdated": "2026-06-05T13:12:50.570Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-11312",
      "date": "2026-08-09",
      "epss": "0.00112",
      "percentile": "0.01586"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-11312\",\"sourceIdentifier\":\"cna@vuldb.com\",\"published\":\"2026-06-05T02:17:10.973\",\"lastModified\":\"2026-07-23T07:10:00.113\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad fue encontrada en bytedance InfiniStore hasta 0.2.33. El elemento afectado es la funci\u00f3n purge_kv_map en la biblioteca /src/infinistore.h del componente Gestor de Mapa KV. Realizar una manipulaci\u00f3n resulta en una complejidad algor\u00edtmica ineficiente. El ataque requiere un enfoque local. El exploit ha sido hecho p\u00fablico y podr\u00eda ser utilizado. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de incidencias pero a\u00fan no ha respondido.\"}],\"affected\":[{\"source\":\"cna@vuldb.com\",\"affectedData\":[{\"vendor\":\"bytedance\",\"product\":\"InfiniStore\",\"cpes\":[\"cpe:2.3:a:bytedance:infinistore:*:*:*:*:*:*:*:*\"],\"modules\":[\"KV Map Handler\"],\"versions\":[{\"version\":\"0.2.0\",\"status\":\"affected\"},{\"version\":\"0.2.1\",\"status\":\"affected\"},{\"version\":\"0.2.2\",\"status\":\"affected\"},{\"version\":\"0.2.3\",\"status\":\"affected\"},{\"version\":\"0.2.4\",\"status\":\"affected\"},{\"version\":\"0.2.5\",\"status\":\"affected\"},{\"version\":\"0.2.6\",\"status\":\"affected\"},{\"version\":\"0.2.7\",\"status\":\"affected\"},{\"version\":\"0.2.8\",\"status\":\"affected\"},{\"version\":\"0.2.9\",\"status\":\"affected\"},{\"version\":\"0.2.10\",\"status\":\"affected\"},{\"version\":\"0.2.11\",\"status\":\"affected\"},{\"version\":\"0.2.12\",\"status\":\"affected\"},{\"version\":\"0.2.13\",\"status\":\"affected\"},{\"version\":\"0.2.14\",\"status\":\"affected\"},{\"version\":\"0.2.15\",\"status\":\"affected\"},{\"version\":\"0.2.16\",\"status\":\"affected\"},{\"version\":\"0.2.17\",\"status\":\"affected\"},{\"version\":\"0.2.18\",\"status\":\"affected\"},{\"version\":\"0.2.19\",\"status\":\"affected\"},{\"version\":\"0.2.20\",\"status\":\"affected\"},{\"version\":\"0.2.21\",\"status\":\"affected\"},{\"version\":\"0.2.22\",\"status\":\"affected\"},{\"version\":\"0.2.23\",\"status\":\"affected\"},{\"version\":\"0.2.24\",\"status\":\"affected\"},{\"version\":\"0.2.25\",\"status\":\"affected\"},{\"version\":\"0.2.26\",\"status\":\"affected\"},{\"version\":\"0.2.27\",\"status\":\"affected\"},{\"version\":\"0.2.28\",\"status\":\"affected\"},{\"version\":\"0.2.29\",\"status\":\"affected\"},{\"version\":\"0.2.30\",\"status\":\"affected\"},{\"version\":\"0.2.31\",\"status\":\"affected\"},{\"version\":\"0.2.32\",\"status\":\"affected\"},{\"version\":\"0.2.33\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":1.9,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":3.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.8,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:S/C:N/I:N/A:P\",\"baseScore\":1.7,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.1,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-05T13:12:38.127231Z\",\"id\":\"CVE-2026-11312\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-404\"},{\"lang\":\"en\",\"value\":\"CWE-407\"}]}],\"references\":[{\"url\":\"https://github.com/bytedance/InfiniStore/\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://github.com/bytedance/InfiniStore/issues/200\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/cve/CVE-2026-11312\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/submit/832348\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/vuln/368398\",\"source\":\"cna@vuldb.com\"},{\"url\":\"https://vuldb.com/vuln/368398/cti\",\"source\":\"cna@vuldb.com\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-06T00:44:05+00:00",
      "cve": "CVE-2026-11312",
      "id": "CVE-2026-11312",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "bytedance InfiniStore KV Map infinistore.h purge_kv_map algorithmic complexity",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11312.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-11312\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-05T13:12:38.127231Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-05T13:12:42.977Z\"}}], \"cna\": {\"title\": \"bytedance InfiniStore KV Map infinistore.h purge_kv_map algorithmic complexity\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Dem00 (VulDB User)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"VulDB CNA Team\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 4.8, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P\"}}, {\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 3.3, \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R\"}}, {\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 3.3, \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R\"}}, {\"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 1.7, \"vectorString\": \"AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR\"}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:bytedance:infinistore:*:*:*:*:*:*:*:*\"], \"vendor\": \"bytedance\", \"modules\": [\"KV Map Handler\"], \"product\": \"InfiniStore\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.2.0\"}, {\"status\": \"affected\", \"version\": \"0.2.1\"}, {\"status\": \"affected\", \"version\": \"0.2.2\"}, {\"status\": \"affected\", \"version\": \"0.2.3\"}, {\"status\": \"affected\", \"version\": \"0.2.4\"}, {\"status\": \"affected\", \"version\": \"0.2.5\"}, {\"status\": \"affected\", \"version\": \"0.2.6\"}, {\"status\": \"affected\", \"version\": \"0.2.7\"}, {\"status\": \"affected\", \"version\": \"0.2.8\"}, {\"status\": \"affected\", \"version\": \"0.2.9\"}, {\"status\": \"affected\", \"version\": \"0.2.10\"}, {\"status\": \"affected\", \"version\": \"0.2.11\"}, {\"status\": \"affected\", \"version\": \"0.2.12\"}, {\"status\": \"affected\", \"version\": \"0.2.13\"}, {\"status\": \"affected\", \"version\": \"0.2.14\"}, {\"status\": \"affected\", \"version\": \"0.2.15\"}, {\"status\": \"affected\", \"version\": \"0.2.16\"}, {\"status\": \"affected\", \"version\": \"0.2.17\"}, {\"status\": \"affected\", \"version\": \"0.2.18\"}, {\"status\": \"affected\", \"version\": \"0.2.19\"}, {\"status\": \"affected\", \"version\": \"0.2.20\"}, {\"status\": \"affected\", \"version\": \"0.2.21\"}, {\"status\": \"affected\", \"version\": \"0.2.22\"}, {\"status\": \"affected\", \"version\": \"0.2.23\"}, {\"status\": \"affected\", \"version\": \"0.2.24\"}, {\"status\": \"affected\", \"version\": \"0.2.25\"}, {\"status\": \"affected\", \"version\": \"0.2.26\"}, {\"status\": \"affected\", \"version\": \"0.2.27\"}, {\"status\": \"affected\", \"version\": \"0.2.28\"}, {\"status\": \"affected\", \"version\": \"0.2.29\"}, {\"status\": \"affected\", \"version\": \"0.2.30\"}, {\"status\": \"affected\", \"version\": \"0.2.31\"}, {\"status\": \"affected\", \"version\": \"0.2.32\"}, {\"status\": \"affected\", \"version\": \"0.2.33\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-04T00:00:00.000Z\", \"value\": \"Advisory disclosed\"}, {\"lang\": \"en\", \"time\": \"2026-06-04T02:00:00.000Z\", \"value\": \"VulDB entry created\"}, {\"lang\": \"en\", \"time\": \"2026-06-04T20:15:15.000Z\", \"value\": \"VulDB entry last update\"}], \"references\": [{\"url\": \"https://vuldb.com/vuln/368398\", \"name\": \"VDB-368398 | bytedance InfiniStore KV Map infinistore.h purge_kv_map algorithmic complexity\", \"tags\": [\"vdb-entry\", \"technical-description\"]}, {\"url\": \"https://vuldb.com/vuln/368398/cti\", \"name\": \"VDB-368398 | CTI Indicators (IOB, IOC, IOA)\", \"tags\": [\"signature\", \"permissions-required\"]}, {\"url\": \"https://vuldb.com/cve/CVE-2026-11312\", \"name\": \"CVE-2026-11312 | CVE Analysis and Report\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://vuldb.com/submit/832348\", \"name\": \"Submit #832348 | bytedance InfiniStore 0.2.33 Denial of Service\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://github.com/bytedance/InfiniStore/issues/200\", \"tags\": [\"exploit\", \"issue-tracking\"]}, {\"url\": \"https://github.com/bytedance/InfiniStore/\", \"tags\": [\"product\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-407\", \"description\": \"Inefficient Algorithmic Complexity\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-404\", \"description\": \"Denial of Service\"}]}], \"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2026-06-05T00:30:14.091Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-11312\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-05T13:12:50.570Z\", \"dateReserved\": \"2026-06-04T18:10:12.303Z\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"datePublished\": \"2026-06-05T00:30:14.091Z\", \"assignerShortName\": \"VulDB\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-11312

Vulnerability from fkie_nvd - Published: 2026-06-05 02:17 - Updated: 2026-07-23 07:10

Severity

3.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Summary

References

	URL	Tags
	cna@vuldb.com	https://github.com/bytedance/InfiniStore/
	cna@vuldb.com	https://github.com/bytedance/InfiniStore/issues/200
	cna@vuldb.com	https://vuldb.com/cve/CVE-2026-11312
	cna@vuldb.com	https://vuldb.com/submit/832348
	cna@vuldb.com	https://vuldb.com/vuln/368398
	cna@vuldb.com	https://vuldb.com/vuln/368398/cti

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:bytedance:infinistore:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "KV Map Handler"
          ],
          "product": "InfiniStore",
          "vendor": "bytedance",
          "versions": [
            {
              "status": "affected",
              "version": "0.2.0"
            },
            {
              "status": "affected",
              "version": "0.2.1"
            },
            {
              "status": "affected",
              "version": "0.2.2"
            },
            {
              "status": "affected",
              "version": "0.2.3"
            },
            {
              "status": "affected",
              "version": "0.2.4"
            },
            {
              "status": "affected",
              "version": "0.2.5"
            },
            {
              "status": "affected",
              "version": "0.2.6"
            },
            {
              "status": "affected",
              "version": "0.2.7"
            },
            {
              "status": "affected",
              "version": "0.2.8"
            },
            {
              "status": "affected",
              "version": "0.2.9"
            },
            {
              "status": "affected",
              "version": "0.2.10"
            },
            {
              "status": "affected",
              "version": "0.2.11"
            },
            {
              "status": "affected",
              "version": "0.2.12"
            },
            {
              "status": "affected",
              "version": "0.2.13"
            },
            {
              "status": "affected",
              "version": "0.2.14"
            },
            {
              "status": "affected",
              "version": "0.2.15"
            },
            {
              "status": "affected",
              "version": "0.2.16"
            },
            {
              "status": "affected",
              "version": "0.2.17"
            },
            {
              "status": "affected",
              "version": "0.2.18"
            },
            {
              "status": "affected",
              "version": "0.2.19"
            },
            {
              "status": "affected",
              "version": "0.2.20"
            },
            {
              "status": "affected",
              "version": "0.2.21"
            },
            {
              "status": "affected",
              "version": "0.2.22"
            },
            {
              "status": "affected",
              "version": "0.2.23"
            },
            {
              "status": "affected",
              "version": "0.2.24"
            },
            {
              "status": "affected",
              "version": "0.2.25"
            },
            {
              "status": "affected",
              "version": "0.2.26"
            },
            {
              "status": "affected",
              "version": "0.2.27"
            },
            {
              "status": "affected",
              "version": "0.2.28"
            },
            {
              "status": "affected",
              "version": "0.2.29"
            },
            {
              "status": "affected",
              "version": "0.2.30"
            },
            {
              "status": "affected",
              "version": "0.2.31"
            },
            {
              "status": "affected",
              "version": "0.2.32"
            },
            {
              "status": "affected",
              "version": "0.2.33"
            }
          ]
        }
      ],
      "source": "cna@vuldb.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad fue encontrada en bytedance InfiniStore hasta 0.2.33. El elemento afectado es la funci\u00f3n purge_kv_map en la biblioteca /src/infinistore.h del componente Gestor de Mapa KV. Realizar una manipulaci\u00f3n resulta en una complejidad algor\u00edtmica ineficiente. El ataque requiere un enfoque local. El exploit ha sido hecho p\u00fablico y podr\u00eda ser utilizado. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de incidencias pero a\u00fan no ha respondido."
    }
  ],
  "id": "CVE-2026-11312",
  "lastModified": "2026-07-23T07:10:00.113",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 1.7,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "cna@vuldb.com",
        "type": "Secondary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 3.3,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 1.4,
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 1.9,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "cna@vuldb.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-11312",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-05T13:12:38.127231Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-05T02:17:10.973",
  "references": [
    {
      "source": "cna@vuldb.com",
      "url": "https://github.com/bytedance/InfiniStore/"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://github.com/bytedance/InfiniStore/issues/200"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/cve/CVE-2026-11312"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/submit/832348"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/vuln/368398"
    },
    {
      "source": "cna@vuldb.com",
      "url": "https://vuldb.com/vuln/368398/cti"
    }
  ],
  "sourceIdentifier": "cna@vuldb.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-404"
        },
        {
          "lang": "en",
          "value": "CWE-407"
        }
      ],
      "source": "cna@vuldb.com",
      "type": "Secondary"
    }
  ]
}

GHSA-2VRG-7RQV-PRF9

Vulnerability from github – Published: 2026-06-05 03:31 – Updated: 2026-07-15 23:37

Summary

bytedance InfiniStore: Denial of Service via Non-Cryptographic Hashing in InfiniStore KV Map

Details

Severity

3.3 (Low)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

1.9 (Low)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "infinistore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.2.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-11312"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-404"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-15T23:37:50Z",
    "nvd_published_at": "2026-06-05T02:17:10Z",
    "severity": "LOW"
  },
  "details": "A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.",
  "id": "GHSA-2vrg-7rqv-prf9",
  "modified": "2026-07-15T23:37:50Z",
  "published": "2026-06-05T03:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11312"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytedance/InfiniStore/issues/200"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bytedance/InfiniStore"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-11312"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/832348"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/368398"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/368398/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "bytedance InfiniStore: Denial of Service via Non-Cryptographic Hashing in InfiniStore KV Map"
}

PYSEC-2026-3469

Vulnerability from pysec - Published: 2026-07-23 11:41 - Updated: 2026-07-23 14:31

Details

Severity

3.3 (Low)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

1.9 (Low)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Impacted products

Name	purl
infinistore	pkg:pypi/infinistore

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "infinistore",
        "purl": "pkg:pypi/infinistore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.2.33"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.100",
        "0.1.101",
        "0.1.115",
        "0.1.128",
        "0.1.129",
        "0.1.136",
        "0.1.137",
        "0.1.152",
        "0.1.72",
        "0.1.73",
        "0.1.74",
        "0.1.82",
        "0.1.89",
        "0.1.90",
        "0.1.91",
        "0.1.96",
        "0.1.98",
        "0.1.99",
        "0.2.11",
        "0.2.22",
        "0.2.32",
        "0.2.33",
        "0.2.7",
        "0.2.8"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-11312",
    "GHSA-2vrg-7rqv-prf9"
  ],
  "details": "A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.",
  "id": "PYSEC-2026-3469",
  "modified": "2026-07-23T14:31:18.406417Z",
  "published": "2026-07-23T11:41:39.091225Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11312"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bytedance/InfiniStore/issues/200"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/bytedance/InfiniStore"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-11312"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/832348"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/368398"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/368398/cti"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/infinistore"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-2vrg-7rqv-prf9"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "bytedance InfiniStore: Denial of Service via Non-Cryptographic Hashing in InfiniStore KV Map"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-11312 (GCVE-0-2026-11312)

FKIE_CVE-2026-11312

GHSA-2VRG-7RQV-PRF9

PYSEC-2026-3469

Tags

Sightings

Nomenclature