CVE-2026-11312

A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS v3 3.3 LOW
CVSS v2.0 1.7 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

1.7^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 3.1 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://github.com/bytedance/InfiniStore/
https://github.com/bytedance/InfiniStore/issues/200
https://vuldb.com/cve/CVE-2026-11312
https://vuldb.com/submit/832348
https://vuldb.com/vuln/368398
https://vuldb.com/vuln/368398/cti

Configurations

No configuration.

History

23 Jul 2026, 07:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad fue encontrada en bytedance InfiniStore hasta 0.2.33. El elemento afectado es la función purge_kv_map en la biblioteca /src/infinistore.h del componente Gestor de Mapa KV. Realizar una manipulación resulta en una complejidad algorítmica ineficiente. El ataque requiere un enfoque local. El exploit ha sido hecho público y podría ser utilizado. El proyecto fue informado del problema tempranamente a través de un informe de incidencias pero aún no ha respondido.

05 Jun 2026, 02:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-05 02:17

Updated : 2026-07-23 07:10

NVD link : CVE-2026-11312

Mitre link : CVE-2026-11312

CVE.ORG link : CVE-2026-11312

JSON object : View

Products Affected

No product.

CWE

CWE-404

Improper Resource Shutdown or Release

CWE-407

Inefficient Algorithmic Complexity

{"id": "CVE-2026-11312", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11312", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-05T13:12:38.127231Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 1.7, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.1, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:bytedance:infinistore:*:*:*:*:*:*:*:*"], "vendor": "bytedance", "modules": ["KV Map Handler"], "product": "InfiniStore", "versions": [{"status": "affected", "version": "0.2.0"}, {"status": "affected", "version": "0.2.1"}, {"status": "affected", "version": "0.2.2"}, {"status": "affected", "version": "0.2.3"}, {"status": "affected", "version": "0.2.4"}, {"status": "affected", "version": "0.2.5"}, {"status": "affected", "version": "0.2.6"}, {"status": "affected", "version": "0.2.7"}, {"status": "affected", "version": "0.2.8"}, {"status": "affected", "version": "0.2.9"}, {"status": "affected", "version": "0.2.10"}, {"status": "affected", "version": "0.2.11"}, {"status": "affected", "version": "0.2.12"}, {"status": "affected", "version": "0.2.13"}, {"status": "affected", "version": "0.2.14"}, {"status": "affected", "version": "0.2.15"}, {"status": "affected", "version": "0.2.16"}, {"status": "affected", "version": "0.2.17"}, {"status": "affected", "version": "0.2.18"}, {"status": "affected", "version": "0.2.19"}, {"status": "affected", "version": "0.2.20"}, {"status": "affected", "version": "0.2.21"}, {"status": "affected", "version": "0.2.22"}, {"status": "affected", "version": "0.2.23"}, {"status": "affected", "version": "0.2.24"}, {"status": "affected", "version": "0.2.25"}, {"status": "affected", "version": "0.2.26"}, {"status": "affected", "version": "0.2.27"}, {"status": "affected", "version": "0.2.28"}, {"status": "affected", "version": "0.2.29"}, {"status": "affected", "version": "0.2.30"}, {"status": "affected", "version": "0.2.31"}, {"status": "affected", "version": "0.2.32"}, {"status": "affected", "version": "0.2.33"}]}]}], "published": "2026-06-05T02:17:10.973", "references": [{"url": "https://github.com/bytedance/InfiniStore/", "source": "cna@vuldb.com"}, {"url": "https://github.com/bytedance/InfiniStore/issues/200", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-11312", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/832348", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/368398", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/368398/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-404"}, {"lang": "en", "value": "CWE-407"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Una vulnerabilidad fue encontrada en bytedance InfiniStore hasta 0.2.33. El elemento afectado es la funci\u00f3n purge_kv_map en la biblioteca /src/infinistore.h del componente Gestor de Mapa KV. Realizar una manipulaci\u00f3n resulta en una complejidad algor\u00edtmica ineficiente. El ataque requiere un enfoque local. El exploit ha sido hecho p\u00fablico y podr\u00eda ser utilizado. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de incidencias pero a\u00fan no ha respondido."}], "lastModified": "2026-07-23T07:10:00.113", "sourceIdentifier": "cna@vuldb.com"}