redhat data grid güvenlik açıkları (CVE)

8.1Yüksek

CVE-2026-16102 3 ay önce

Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

Red Hat Red Hat build of Keycloak 26.4; Red Hat Red Hat build of Keycloak 26.4.14; Red Hat Red Hat build of Keycloak 26.6; Red Hat Red Hat build of Keycloak 26.6.5

A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive…

8.1Yüksek

CVE-2026-15573 3 ay önce

Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher

Red Hat Red Hat build of Keycloak 26.4; Red Hat Red Hat build of Keycloak 26.4.14; Red Hat Red Hat build of Keycloak 26.6; Red Hat Red Hat build of Keycloak 26.6.5

A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix param…

5.4Orta

CVE-2026-16093 3 ay önce

Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers

Red Hat Red Hat build of Keycloak 26.6; Red Hat Red Hat build of Keycloak 26.6.7; Red Hat Red Hat Data Grid 8; Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack

Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be bypassed. An attacker with valid client credent…

4.3Orta

CVE-2026-15945 3 ay önce

Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2

Red Hat Red Hat build of Keycloak 26.6; Red Hat Red Hat build of Keycloak 26.6.7; Red Hat Red Hat Data Grid 8; Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack

A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to…

7.0Yüksek

CVE-2026-44495 5 ay önce

Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

axios axios; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Ob…

8.7Yüksek

CVE-2026-28369 7 ay önce

Undertow: undertow: request smuggling via malformed http request headers

Red Hat Red Hat JBoss Enterprise Application Platform 8.1.6; Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8; Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9; Red Hat Red Hat build of Apache Camel for Spring Boot 4

A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be explo…

8.7Yüksek

CVE-2026-28367 7 ay önce

Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator

Red Hat Red Hat JBoss Enterprise Application Platform 8.1.6; Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8; Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9; Red Hat Red Hat build of Apache Camel for Spring Boot 4

A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Clou…

8.7Yüksek

CVE-2026-28368 7 ay önce

Undertow: undertow: request smuggling via inconsistent header parsing

Red Hat Red Hat JBoss Enterprise Application Platform 8.1.6; Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8; Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9; Red Hat Red Hat build of Apache Camel for Spring Boot 4

A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to…

9.6Kritik

CVE-2025-12543 10 ay önce

Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

Red Hat Red Hat build of Apache Camel 4.14.4 for Spring Boot 3.5.11; Red Hat Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7; Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7; Red Hat Red Hat JBoss Enterprise Application Platform 7.4.24

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malici…

1.3%EPSS

5.5Orta

CVE-2025-5731 1 yıl önce

Infinispan: credential leakage in infinispan cli

Red Hat infinispan; Red Hat Red Hat Data Grid 8.5.4; Red Hat Red Hat JBoss Enterprise Application Platform 7; Red Hat Red Hat JBoss Enterprise Application Platform 8

A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.

8.1Yüksek

CVE-2025-23368 1 yıl önce

Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

wildfly-core; Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7; Red Hat Red Hat JBoss Enterprise Application Platform 8.1.6.GA; Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.

7.5Yüksek

CVE-2024-7885 2 yıl önce

Undertow: improper state management in proxy protocol parsing causes information leakage

undertow; Red Hat HawtIO 4.0.0 for Red Hat build of Apache Camel 4; Red Hat Red Hat build of Apache Camel 3.20.7 for Spring Boot; Red Hat Red Hat build of Apache Camel 4.4.2 for Spring Boot

A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a res…

2.6%EPSS

4.4Orta

CVE-2023-5236 2 yıl önce

Infinispan: circular reference on marshalling leads to dos

Red Hat Red Hat Data Grid 8.4.4; Red Hat Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat Red Hat build of Apache Camel for Spring Boot 4; Red Hat Red Hat build of Debezium 2

A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors an…

1.1%EPSS