Jboss Data Grid (Redhat) - vulnerabilities (CVEs)

224 CVEs, 1 in the last 30 days, 15 known versions, newest CVE from 2026-10-26. Vendor: Redhat.

CVEs of Jboss Data Grid

CVE-2026-92171 - CVSS 6.5 (medium), 2026-10-26: A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container…
CVE-2026-93562 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request…
CVE-2026-93574 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1…
CVE-2026-93579 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage…
CVE-2026-93573 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the…
CVE-2026-93568 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's…
CVE-2026-85511 - CVSS 4.2 (medium), 2026-09-18: A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow…
CVE-2026-93569 - CVSS 8.2 (high), 2026-09-18: A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1…
CVE-2026-93567 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the…
CVE-2026-10832 - CVSS 5.9 (medium), 2026-09-18: A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a…
CVE-2026-93566 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the…
CVE-2026-93565 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time…
CVE-2026-93558 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to…
CVE-2026-93492 - CVSS 5.3 (medium), 2026-09-18: A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE.…
CVE-2026-93491 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single…
CVE-2026-93488 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to…
CVE-2026-17526 - CVSS 7.2 (high), 2026-09-16: Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a…
CVE-2026-18212 - CVSS 7.5 (high), 2026-09-16: A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the…
CVE-2026-5680 - CVSS 7.5 (high), 2026-08-27: A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate…
CVE-2026-19611 - CVSS 7.4 (high), 2026-08-20: A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII…
CVE-2026-15571 - CVSS 7.3 (high), 2026-08-18: A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The…
CVE-2026-14180 - CVSS 5.3 (medium), 2026-08-11: A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The…
CVE-2026-15565 - CVSS 7.5 (high), 2026-08-11: A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has…
CVE-2026-16442 - CVSS 9.8 (critical), 2026-08-05: A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the…
CVE-2026-16100 - CVSS 6.5 (medium), 2026-08-05: A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account…
CVE-2026-16071 - CVSS 5.4 (medium), 2026-08-05: A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a…
CVE-2026-16102 - CVSS 8.1 (high), 2026-08-05: A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to…
CVE-2026-15573 - CVSS 8.1 (high), 2026-08-05: A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not…
CVE-2026-16443 - CVSS 9.1 (critical), 2026-08-05: A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat…
CVE-2026-18569 - CVSS 3.7 (low), 2026-08-04: A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles…
CVE-2026-18573 - CVSS 6.5 (medium), 2026-08-02: A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a…
CVE-2026-18572 - CVSS 6.5 (medium), 2026-08-02: Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access…
CVE-2026-18571 - CVSS 7.2 (high), 2026-08-02: A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator…
CVE-2026-18570 - CVSS 5.4 (medium), 2026-08-02: A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing…
CVE-2026-18209 - CVSS 4.7 (medium), 2026-07-31: A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the…
CVE-2026-18206 - CVSS 3.7 (low), 2026-07-31: A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm…
CVE-2026-18203 - CVSS 6.5 (medium), 2026-07-31: A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend…
CVE-2026-18214 - CVSS 8.1 (high), 2026-07-31: Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where…
CVE-2026-18211 - CVSS 5.4 (medium), 2026-07-31: A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security…
CVE-2026-18208 - CVSS 6.5 (medium), 2026-07-31: A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management…
CVE-2026-16105 - CVSS 4.9 (medium), 2026-07-31: A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not…
CVE-2026-18215 - CVSS 8.1 (high), 2026-07-31: Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where…
CVE-2026-18217 - CVSS 4.7 (medium), 2026-07-31: A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak…
CVE-2026-18218 - CVSS 5.4 (medium), 2026-07-31: A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific…
CVE-2026-18201 - CVSS 5.5 (medium), 2026-07-29: Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with…
CVE-2026-18207 - CVSS 6.5 (medium), 2026-07-29: A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique…
CVE-2026-17059 - CVSS 6.5 (medium), 2026-07-24: A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management…
CVE-2026-17048 - CVSS 5.5 (medium), 2026-07-24: A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for…
CVE-2026-16104 - CVSS 6.5 (medium), 2026-07-17: A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak…
CVE-2026-16103 - CVSS 4.3 (medium), 2026-07-17: A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were…
CVE-2026-16106 - CVSS 4.9 (medium), 2026-07-17: A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to…
CVE-2026-16108 - CVSS 6.5 (medium), 2026-07-17: A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are…
CVE-2026-16093 - CVSS 5.4 (medium), 2026-07-17: Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for…
CVE-2026-16089 - CVSS 5.9 (medium), 2026-07-17: A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly…
CVE-2026-16072 - CVSS 4.9 (medium), 2026-07-17: A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an…
CVE-2026-15943 - CVSS 5.5 (medium), 2026-07-17: A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated…
CVE-2026-15945 - CVSS 4.3 (medium), 2026-07-16: A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a…
CVE-2026-14781 - CVSS 4.8 (medium), 2026-07-05: A flaw exists in the org.keycloak.broker.oidc package where the OIDC broker incorrectly synchronizes the email_verified claim. When an OIDC identity provider…
CVE-2026-14614 - CVSS 5.4 (medium), 2026-07-03: A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a…
CVE-2026-14613 - CVSS 4.9 (medium), 2026-07-03: A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have…
CVE-2026-13676 - CVSS 7.5 (high), 2026-06-29: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that…
CVE-2026-57915 - CVSS 7.3 (high), 2026-06-26: It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are…
CVE-2026-11800 - CVSS 8.1 (high), 2026-06-25: A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials…
CVE-2026-54513 - CVSS 8.1 (high), 2026-06-23: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and…
CVE-2026-48779 - CVSS 7.5 (high), 2026-06-16: ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up…
CVE-2026-12143 - CVSS 8.7 (high), 2026-06-12: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the…
CVE-2026-50010 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,…
CVE-2026-50011 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,…
CVE-2026-47691 - CVSS 10 (critical), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's…
CVE-2026-48059 - CVSS 8.7 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY…
CVE-2026-48043 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and…
CVE-2026-48006 - CVSS 8.7 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the…
CVE-2026-46340 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and…
CVE-2026-45674 - CVSS 10 (critical), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's…
CVE-2026-45416 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,…
CVE-2026-44893 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and…
CVE-2026-44250 - CVSS 7.5 (high), 2026-06-11: Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and…
CVE-2026-44249 - CVSS 8.1 (high), 2026-06-11: Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final,…
CVE-2026-44890 - CVSS 7.5 (high), 2026-06-11: Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and…
CVE-2026-44495 - CVSS 7.7 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in…
CVE-2026-44494 - CVSS 8.7 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution…
CVE-2026-44492 - CVSS 8.6 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When…
CVE-2026-44496 - CVSS 7.5 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a…
CVE-2026-44488 - CVSS 7.5 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size…
CVE-2026-44487 - CVSS 8.2 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization…
CVE-2026-44486 - CVSS 7.5 (high), 2026-06-11: Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a…
CVE-2026-40984 - CVSS 7.5 (high), 2026-06-09: In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions:…
CVE-2026-40983 - CVSS 7.5 (high), 2026-06-09: In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions:…
CVE-2024-52011 - CVSS 8.3 (high), 2026-06-01: launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file`…
CVE-2026-45292 - CVSS 7.5 (high), 2026-05-28: opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to…
CVE-2026-9277 - CVSS 9.2 (critical), 2026-05-22: shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped…
CVE-2026-41292 - CVSS 7.5 (high), 2026-05-20: NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to a degradation of service attack related to parsing long lists of incoming EDNS options.…
CVE-2026-45736 - CVSS 7.5 (high), 2026-05-15: ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory…
CVE-2026-44248 - CVSS 7.5 (high), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed…
CVE-2026-42587 - CVSS 7.5 (high), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation…
CVE-2026-42584 - CVSS 9.1 (critical), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response…
CVE-2026-42581 - CVSS 9.8 (critical), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting…
CVE-2026-42579 - CVSS 9.1 (critical), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035…
CVE-2026-42578 - CVSS 7.5 (high), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP…
CVE-2026-42264 - CVSS 9.1 (critical), 2026-05-08: Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL,…