Redhat Data Grid vulnerabilities

• red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +7 more +9 more Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers CVE-2026-16102 Fix available 8.1 HighAugust 5, 2026
• red hat build of keycloak 26.4, build of keycloak 26.4.14, build of keycloak 26.6 +7 more +9 more Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher CVE-2026-15573 Fix available 8.1 HighAugust 5, 2026
• red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +5 more +7 more Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers CVE-2026-16093 Fix available 5.4 MediumJuly 17, 2026
• red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +5 more +7 more Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2 CVE-2026-15945 Fix available 4.3 MediumJuly 16, 2026
• axios, red hat cryostat 4, gatekeeper 3 +79 more +81 more Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge CVE-2026-44495 Fix available 7.0 HighMay 29, 2026
• redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +21 more +23 more Undertow: undertow: request smuggling via malformed http request headers CVE-2026-28369 Fix available 8.7 HighMarch 27, 2026
• redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +20 more +22 more Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator CVE-2026-28367 Fix available 8.7 HighMarch 27, 2026
• redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +21 more +23 more Undertow: undertow: request smuggling via inconsistent header parsing CVE-2026-28368 Fix available 8.7 HighMarch 27, 2026
• redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel 4.14.4 for spring boot 3.5.11 +33 more +35 more Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf CVE-2025-12543 Fix available 9.6 CriticalJanuary 7, 2026
• infinispan, red hat data grid 8.5.4, jboss enterprise application platform 7 +4 more +6 more Infinispan: credential leakage in infinispan cli CVE-2025-5731 5.5 MediumJune 26, 2025
• red hat build of keycloak, data grid 8, fuse 7 +13 more +15 more Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli CVE-2025-23368 Fix available 8.1 HighMarch 4, 2025
• red hat hawtio 4.0.0 for red hat build of apache camel 4, build of apache camel 3.20.7 for spring boot, build of apache camel 4.4.2 for spring boot +26 more +28 more Undertow: improper state management in proxy protocol parsing causes information leakage CVE-2024-7885 Fix available 7.5 HighAugust 21, 2024
• infinispan, red hat data grid 8.4.6, redhat data grid +1 more +3 more Infinispan: credentials returned from configuration as clear text CVE-2023-5384 Fix available 7.2 HighDecember 18, 2023
• infinispan, red hat build of apache camel 4 for quarkus 3, build of apache camel for spring boot 4 +13 more +15 more Infinispan: circular reference on marshalling leads to dos CVE-2023-5236 Fix available 4.4 MediumDecember 18, 2023
• infinispan, red hat data grid 8.4.4, jboss enterprise application platform 6 +3 more +5 more Infinispan: non-admins should not be able to get cache config via rest api CVE-2023-3629 Fix available 4.3 MediumDecember 18, 2023
• infinispan, red hat data grid 8.4.4, jboss enterprise application platform 6 +3 more +5 more Infispan: rest bulk ops don't check permissions CVE-2023-3628 Fix available 6.5 MediumDecember 18, 2023
• infinispan hot rod, red hat data grid 8.4.6, redhat data grid +2 more Hotrod-client: hot rod client does not enable hostname validation when using tls that lead to a mitm attack CVE-2023-4586 7.4 HighOctober 4, 2023
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• gnu gzip, debian linux, redhat jboss data grid +5 more +7 more An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is... CVE-2022-1271 Fix available 8.8 HighApril 7, 2022
• apache log4j, apache software foundation log4j 1.x, fedoraproject fedora +44 more +46 more Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 CVE-2021-4104 Public exploitFix available EPSS 80.6% 7.5 HighDecember 14, 2021
• infinispan infinispan-server-rest, redhat data grid +1 more A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0... CVE-2021-31917 9.8 CriticalSeptember 21, 2021
• redhat wildfly elytron, quarkus, redhat build of quarkus +11 more +13 more Observable Discrepancy in Wildfly Elytron CVE-2021-3642 Fix available 5.3 MediumAugust 5, 2021
• redhat xnio, oracle communications cloud native core console, communications cloud native core network repository function +11 more +13 more Uncontrolled Resource Consumption in XNIO CVE-2020-14340 Fix available 5.9 MediumJune 2, 2021
• red hat infinispan, infinispan infinispan-server-rest, netapp oncommand insight +1 more +3 more A flaw was found in Infinispan version 10, where it is possible to perform various actions that... CVE-2020-10771 7.1 HighJune 2, 2021
• red hat wildfly, redhat build of quarkus, data grid +6 more +8 more Cross-site Scripting in Wildfly CVE-2021-3536 Fix available 4.8 MediumMay 20, 2021
• infinispan, netapp active iq unified manager, redhat data grid +2 more Improper Access Control in infinispan-server-runtime CVE-2020-25711 Fix available 6.5 MediumDecember 3, 2020
• redhat wildfly, netapp active iq unified manager, oncommand insight +8 more +10 more Uncontrolled Resource Consumption in WildFly CVE-2020-25689 Fix available 5.3 MediumOctober 30, 2020
• redhat wildfly openssl, netapp oncommand insight, oncommand workflow automation +7 more +9 more Wildfly-OpenSSL memory leak flaw CVE-2020-25644 Fix available 7.5 HighOctober 6, 2020
• red hat, inc. jboss enterprise application platform, redhat jboss data grid, openshift application runtimes +1 more +3 more The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to... CVE-2020-1710 5.3 MediumSeptember 16, 2020
• hibernate orm, quarkus, redhat build of quarkus +7 more +9 more SQL Injection in Hibernate ORM CVE-2019-14900 Public exploitFix available 6.5 MediumJuly 6, 2020
• red hat undertow, redhat jboss data grid, jboss enterprise application platform +3 more +5 more Improper Input Validation in Undertow CVE-2020-1757 Fix available 8.1 HighApril 21, 2020
• red hat wildfly, redhat jboss data grid, jboss enterprise application platform +3 more +5 more Inadequate Encryption Strength and Algorithm Downgrade in Wildfly CVE-2019-14887 7.4 HighMarch 16, 2020
• fasterxml jackson-databind, apache geode, redhat decision manager +5 more +7 more Polymorphic deserialization of malicious object in jackson-databind CVE-2019-14892 Fix available 7.5 HighMarch 2, 2020
• red hat undertow, netapp active iq unified manager, redhat jboss data grid +3 more +5 more Undertow vulnerable to Uncontrolled Resource Consumption CVE-2019-14888 Fix available 7.5 HighJanuary 23, 2020
• infinispan, redhat jboss data grid +1 more Improper implementation of the session fixation protection in Infinispan CVE-2019-10158 Fix available 5.4 MediumJanuary 2, 2020
• [unknown] infinispan, netapp active iq unified manager, redhat fuse +4 more +6 more Use of Externally-Controlled Input to Select Classes or Code in Infinispan CVE-2019-10174 Fix available 7.5 HighNovember 25, 2019
• hibernate hibernate-validator, netapp active iq unified manager, element +185 more +187 more The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks CVE-2019-10219 Public exploitFix available 6.5 MediumNovember 8, 2019
• red hat wildfly-core, redhat data grid, jboss enterprise application platform +2 more +4 more Wildfly Authorization Misconfiguration CVE-2019-14838 Fix available 5.2 MediumOctober 14, 2019
• red hat undertow, netapp active iq unified manager, redhat jboss data grid +4 more +6 more Potential to access user credentials from the log files when debug logging enabled CVE-2019-10212 Fix available 4.8 MediumOctober 2, 2019
• red hat undertow, netapp active iq unified manager, redhat jboss data grid +3 more +5 more Undertow Missing Authorization when requesting a protected directory without trailing slash CVE-2019-10184 Fix available 5.3 MediumJuly 25, 2019
• red hat undertow, netapp active iq unified manager, redhat jboss data grid +3 more +5 more Credential exposure through log files in Undertow CVE-2019-3888 Fix available 5.3 MediumJune 12, 2019
• [unknown] infinispan, redhat jboss data grid +1 more Infinispan Rest API Does Not Enforce Auth Constraints CVE-2017-2638 Fix available 6.5 MediumJuly 16, 2018
• infinispan, redhat jboss data grid +1 more Deserialization of Untrusted Data in Infinispan CVE-2018-1131 Fix available 8.8 HighMay 15, 2018
• netty, apache cassandra, redhat jboss data grid +1 more +3 more Loop with Unreachable Exit Condition in Netty CVE-2016-4970 Fix available EPSS 11.3% 7.5 HighApril 13, 2017
• redhat data grid, jboss a-mq, openshift +12 more +14 more Deserialization of Untrusted Data in Apache commons collections CVE-2015-7501 Known exploitedPublic exploitFix available EPSS 85.6% 9.8 CriticalJanuary 14, 2016