CVE-2026-11312: InfiniStore Algorithmic Complexity DoS Vulnerability

Technical summary

CVE-2026-11312 is an algorithmic complexity vulnerability in the purge_kv_map function within InfiniStore's KV Map Handler (/src/infinistore.h). The flaw stems from insufficient input validation or algorithmic efficiency in the purge routine, classified under CWE-404 (Uninitialized Variable) and CWE-407 (Inefficient Algorithmic Complexity). A local, authenticated attacker can supply specially crafted data that triggers worst-case time complexity, resulting in denial of service through resource exhaustion rather than code execution or data compromise.

Business impact

For organizations using InfiniStore as part of their data infrastructure, this vulnerability poses a localized denial-of-service risk. If an insider or compromised local account can reach the service, they can degrade performance or cause temporary unavailability of the KV store. The impact is contained to availability; confidentiality and integrity are not affected. However, in multi-tenant or cloud environments where InfiniStore is shared, a malicious tenant could disrupt service for others.

Affected systems

ByteDance InfiniStore versions 0.2.33 and earlier are affected. The vulnerability is present in the KV Map Handler component. No vendor product list is available in the advisory data, so end-users should verify their dependency versions and consult ByteDance's project repository for a complete list of impacted deployments. Organizations should audit their software supply chain for direct or transitive InfiniStore dependencies.

Exploitability

Public exploit code is available, lowering the barrier to weaponization. However, exploitation requires local system access and valid user credentials, which significantly constrains real-world risk in most environments. Remote exploitation is not possible. The attack does not require user interaction or special configuration, only the ability to invoke the purge_kv_map function with malicious input. Organizations with strict local access controls and user privilege separation are at reduced risk.

Remediation

Update InfiniStore to a patched version beyond 0.2.33. Verify the availability of a security release from ByteDance; as of the advisory modification date (2026-06-17), the project had not yet responded to the early disclosure. Monitor the ByteDance InfiniStore repository for security updates. In the interim, restrict local system access and enforce principle of least privilege for accounts that can interact with the KV store. Consider network segmentation if InfiniStore is exposed to untrusted local networks.

Patch guidance

Upgrade InfiniStore to the earliest available version after 0.2.33 that includes a fix for CVE-2026-11312. Check the official ByteDance InfiniStore GitHub repository (or vendor advisory) for patch availability and release notes. If a patch is not yet available, coordinate with your security team on compensating controls such as access restrictions, monitoring, and privilege review. Document the reason for any delayed patching to meet compliance requirements.

Detection guidance

Monitor for unusual CPU or resource consumption by InfiniStore processes, particularly correlated with purge_kv_map function calls. Log and alert on failed or anomalous KV map operations. Implement application-level monitoring to detect repeated or pathological purge operations with unusual argument patterns. Code review or static analysis of purge_kv_map invocations in your codebase can identify whether locally-accessible code paths could be exploited. Check for unexpected local account access to systems running InfiniStore.

Why prioritize this

Despite a low CVSS score (3.3), this vulnerability should not be ignored. The availability of public exploits and the presence in a widely-used library justify timely patching. However, the requirement for local access means this is lower priority than remote code execution flaws. Prioritize based on your environment: teams using InfiniStore in single-tenant, air-gapped, or tightly-controlled environments may safely defer; those with multi-tenant, cloud-native, or untrusted-local-user exposure should patch sooner.

Risk score, explained

CVSS 3.1 score of 3.3 (LOW) reflects the attack vector (local only), required privileges (low), and impact scope (availability only, no CIA compromise). The score does not account for the existence of public exploits or the attack's feasibility in supply-chain contexts. For organizations where local account compromise is a realistic threat model, consider the practical risk to be higher than the base score suggests.

Frequently asked questions