A flaw in the Ickle query parser allows an authenticated user with BULK_READ permission to submit cache queries containing deeply nested predicates. The parser recurses until the Java thread stack is exhausted, causing an uncaught StackOverflowError and terminating the query execution, which disrupts the service handling the query.

Affected vendors and products include Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 8, the Red Hat JBoss Enterprise Application Platform Expansion Pack, and the Red Hat build of Apache Camel 4 for Quarkus 3. The CVE data does not specify precise version numbers, but the issue applies to the current releases of these products that incorporate the Ickle query parser.

The CVSS score of 4.3 indicates low severity. Exploitation requires authenticated access with BULK_READ permission and the ability to submit a cache query, making it a more limited threat vector. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting that exploitation is unlikely at present. However, an attacker could still trigger temporary service outages on systems that employ the query feature, especially if bulk read privileges are widely assigned. Monitoring and limiting such privileges mitigates risk.