Data Grid vulnerabilities
9 known vulnerabilities in Data Grid from Red Hat. 9 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.1 High severity
Red Hat build of Keycloak 26.4: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive
- 8.1 High severity
Red Hat build of Keycloak 26.4: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parame
- 9.1 Critical severity
Red Hat JBoss Enterprise Application Platform…: Inconsistent Interpretation of HTTP Requests
A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploi
- 9.1 Critical severity
Red Hat JBoss Enterprise Application Platform…: Inconsistent Interpretation of HTTP Requests
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to
- 9.1 Critical severity
Red Hat JBoss Enterprise Application Platform…: Inconsistent Interpretation of HTTP Requests
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud
- 9.6 Critical severity
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and…
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicio
- 8.1 High severity
Red Hat JBoss Enterprise Application Platform…: Improper Restriction of Excessive Authentication Attempts
A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.
- 7.5 High severity
HawtIO 4.0.0 for Red Hat build of Apache Camel 4: Concurrent Execution using Shared Resource with Improper Synchronization
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a resu
- 7.4 High severity
Red Hat Data Grid 8.4.6: Improper Certificate Validation
A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack.