Red Hat Security Advisory

RHSA-2026:41951

Red Hat Data Grid 8.6.2 security update

Released 2026-07-20 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Data Grid 8.6.2

Fixes 38 records

TI-2026-10456 CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

HIGH 77

form-data is a library for creating readable multipart/form-data streams.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00669 Published 2026-06-12 Partial fix · 2.5.6, 3.0.5 +1 CWE-93

TI-2026-32427 CVE-2026-44492 · GHSA-pjwm-pj3p-43mv

Server-side request forgery in axios

HIGH 76

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.1228 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-918

TI-2026-30578 CVE-2026-42264 · GHSA-q8qp-cvcw-x6jj

Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

HIGH 74

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00797 Published 2026-05-08 Partial fix · 1.15.2 CWE-1321

TI-2026-32428 CVE-2026-44494 · GHSA-35jp-ww65-95wh

Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

HIGH 73

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.01057 Published 2026-06-11 Partial fix · 1.16.0 CWE-1321

TI-2026-32430 CVE-2026-44496 · GHSA-hfxv-24rg-xrqf

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05405 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-1333

TI-2026-32424 CVE-2026-44488 · GHSA-777c-7fjr-54vf

Axios: Allocation of Resources Without Limits or Throttling in axios

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00669 Published 2026-06-11 Partial fix · 1.16.0 CWE-770

TI-2026-32422 CVE-2026-44486 · GHSA-j5f8-grm9-p9fc

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

HIGH 72

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00552 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-200

TI-2026-30867 CVE-2026-42587 · GHSA-f6hv-jmp6-3vwv

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

HIGH 72

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0099 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-400

TI-2026-30863 CVE-2026-42583 · GHSA-mj4r-2hfc-f8p6

Netty: Lz4FrameDecoder resource exhaustion

HIGH 72

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00461 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-400

TI-2026-39358 CVE-2026-54512 · GHSA-j3rv-43j4-c7qm

jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation

HIGH 70

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01066 Published 2026-06-23 Partial fix · 2.18.8, 2.21.4 +1 CWE-184

TI-2026-32429 CVE-2026-44495 · GHSA-3g43-6gmg-66jw

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

HIGH 69

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.7 Network No auth No interaction EPSS 0.00854 Published 2026-06-11 Partial fix · 1.15.2, 0.31.1 CWE-1321

TI-2026-32423 CVE-2026-44487 · GHSA-p92q-9vqr-4j8v

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

HIGH 69

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00689 Published 2026-06-11 Partial fix · 1.16.0, 0.32.0 CWE-201

TI-2026-35500 CVE-2026-48059 · GHSA-h2qv-fj59-j46j

Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

MEDIUM 45

Netty is a network application framework for development of protocol servers and clients.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0063 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-401

TI-2026-35451 CVE-2026-48006 · GHSA-6jv9-x5w9-2ccm

Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

MEDIUM 45

Netty is a network application framework for development of protocol servers and clients.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0074 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-401

TI-2026-35195 CVE-2026-47691 · GHSA-5pvg-856g-cp85

Netty has Insufficient Bailiwick Validation for NS Records

MEDIUM 43

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00372 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-345

TI-2026-33416 CVE-2026-45674 · GHSA-676x-f7gg-47vc

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

MEDIUM 43

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00292 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-345

TI-2026-33205 CVE-2026-45416 · GHSA-x4gw-5cx5-pgmh

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

MEDIUM 41

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00921 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-770

TI-2026-39359 CVE-2026-54513 · GHSA-rmj7-2vxq-3g9f

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

MEDIUM 40

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01226 Published 2026-06-23 Partial fix · 2.18.8, 2.21.4 +1 CWE-184

TI-2026-35485 CVE-2026-48043 · GHSA-c2gf-v879-257j

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

MEDIUM 40

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00753 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-400

TI-2026-34060 CVE-2026-46340 · GHSA-5xrh-qmmq-w6ch

Netty: SCTP reassembly nests buffers without bound

MEDIUM 40

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00606 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-770

TI-2026-32768 CVE-2026-44893 · GHSA-cc37-9q2j-3hfv

Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

MEDIUM 40

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00617 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-703

TI-2026-32225 CVE-2026-44248 · GHSA-jfg9-48mv-9qgx

Netty: Resource exhaustion in MqttDecoder

MEDIUM 40

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00563 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-400

TI-2026-29635 CVE-2026-40984 · GHSA-g3pr-3p32-fp23

Micrometer HTTP server instrumentations DoS vulnerability

MEDIUM 40

In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00792 Published 2026-06-09 Partial fix · 1.16.5.1, 1.15.11.1 +7 CWE-400

TI-2026-29634 CVE-2026-40983 · GHSA-w737-wx49-qj23

Micrometer gRPC server instrumentation DoS vulnerability

MEDIUM 40

In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00631 Published 2026-06-09 Partial fix · 1.16.5.1, 1.15.11.1 +2 CWE-400

TI-2026-36837 CVE-2026-50011 · GHSA-5w86-c3rq-vjj7

Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length

LOW 39

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00461 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-400

TI-2026-36836 CVE-2026-50010 · GHSA-c653-97m9-rcg9

Netty's wrapping plain trust manager silently disables hostname verification

LOW 39

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00491 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-347

TI-2026-32765 CVE-2026-44890 · GHSA-6ghj-frrj-jjj3

Netty has Unbounded Direct Memory Consumption in its RedisDecoder

LOW 39

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00461 Published 2026-06-11 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-400

TI-2026-32227 CVE-2026-44250 · GHSA-3244-j874-rhc2

Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays

LOW 39

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00461 Published 2026-06-11 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-400

TI-2026-32226 CVE-2026-44249 · GHSA-3qp7-7mw8-wx86

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

LOW 39

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00987 Published 2026-06-11 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-284

TI-2026-30645 CVE-2026-42342 · GHSA-8x6r-g9mw-2r78

React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

LOW 39

React Router is a router for React.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00299 Published 2026-06-02 Partial fix · 7.15.0, 2.17.5 CWE-400

TI-2026-26400 CVE-2026-34077 · GHSA-rxv8-25v2-qmq8

React Router vulnerable to Denial of Service via reflected user input in single-fetch

LOW 39

React Router is a router for React.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00294 Published 2026-06-02 Partial fix · 7.14.0, 3.0.0 CWE-770

TI-2026-05546 CVE-2026-6322 · GHSA-v39h-62p7-jpjc

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

LOW 39

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00512 Published 2026-05-05 Partial fix · 3.1.2, 2.4.1 CWE-436

TI-2026-30532 CVE-2026-42211 · GHSA-49rj-9fvp-4h2h

Deserialization of untrusted data in remix-run react-router

LOW 37

React Router is a router for React.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00416 Published 2026-06-02 Partial fix · 7.14.2 CWE-502

TI-2026-36952 CVE-2026-50193 · GHSA-3wrr-7qpf-2prh

jackson-databind: Deeply nested JsonNode throws StackOverflowError for toString()

LOW 35

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00616 Published 2026-06-23 Partial fix · 2.14.0 CWE-400

TI-2026-25663 CVE-2026-33245 · GHSA-8646-j5j9-6r62

React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

LOW 34

React Router is a router for React.

CVSS 3.1HIGH 8.0 Network No auth User interaction EPSS 0.00189 Published 2026-06-02 Partial fix · 7.13.2 CWE-79

TI-2026-30866 CVE-2026-42586 · GHSA-rgrr-p7gp-5xj7

Netty: CRLF Injection in Netty Redis Codec Encoder

LOW 31

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00217 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-93

TI-2026-08430 CVE-2026-9595 · GHSA-mx8g-39q3-5c79

webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies

LOW 29

Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00163 Published 2026-06-15 Partial fix · 5.2.5 CWE-346

TI-2026-33092 CVE-2026-45292 · GHSA-rcgg-9c38-7xpx

opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

LOW 26

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01097 Published 2026-05-28 Partial fix · 1.62.0 CWE-770