indepth analysis: https://docs.google.com/document/d/1XdX8AJzGjBgCLE0UZ5N_RGGrzQ14HSVS8HcDgH0X70w/edit?tab=t.d440c4doqxdr#bookmark=kix.x2zmvwn62x0k

default JGroups protocol stacks ship without the AUTH protocol, allowing any network-adjacent host to join the cluster, and the Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.

The root cause is CWE-502 (Deserialization of Untrusted Data) in the session replication marshalling path, combined with CWE-306 (Missing Authentication for Critical Function) on the JGroups cluster join interface. CVE-2016-2141 addressed AUTH bypass when AUTH was configured, but did not add AUTH to default stacks. CVE-2025-2251 addresses the same River unmarshaller deficiency in the EJB remote invocation path only — the fix commit (2656bb7) modified only ejb3/src/main/java/org/jboss/as/ejb3/subsystem/FilterSpecClassResolverFilter.java, leaving the Infinispan clustering marshaller completely unprotected.

Fix must add ClassResolverFilter to the SessionMarshallerFactory.JBOSS / JBossByteBufferMarshaller path in wildfly-clustering-web-extension