CVE-2026-11312CWE-404CWE-407

bytedance InfiniStore KV Map infinistore.h purge_kv_map algorithmic complexity

Medium · published June 5, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
1.3
In the wild
Unconfirmed
What it is

A vulnerability was found in bytedance InfiniStore up to 0.2.33. The impacted element is the function purge_kv_map in the library /src/infinistore.h of the component KV Map Handler. Performing a manipulation results in inefficient algorithmic complexity. The attack requires a local approach. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00112 · 1.3th percentile
Weaknesses
CWE-404 · Improper Resource Shutdown or Release; CWE-407 · Inefficient Algorithmic Complexity
Published
2026-06-05T00:30Z
EPSS history
Timeline
  • 05 JUN 00:30Z
    bytedance InfiniStore KV Map infinistore.h purge_kv_map algorithmic complexity
    cvelistv5