Loading story…
Red Hat released Red Hat Data Grid 8.6.1 and later 8.6.2 to remediate multiple Important security issues in bundled components affecting Red Hat JBoss Data Grid. The advisories cite vulnerabilities in Netty, Axios, Spring Boot, lodash, DOMPurify, Apache Log4j, jackson-databind, React Router, Micrometer, OpenTelemetry Java, form-data, fast-uri, and webpack-dev-server, with impacts including remote or arbitrary code execution, denial of service, request smuggling, authentication bypass, information disclosure, prototype pollution, hostname verification bypass, command injection, log injection, and cross-site scripting.
One of the disclosed flaws, CVE-2026-9595 in webpack-dev-server, could let an overly broad proxy configuration with ws: true intercept Hot Module Replacement WebSocket traffic, exposing browser cookies and the Origin header to a proxy backend while also bypassing Host and Origin checks and disrupting the HMR socket. Red Hat said the issue was fixed in Data Grid 8.6.2, and advised customers to update from earlier releases, while mitigations for affected development environments include limiting proxy contexts to specific paths instead of / and avoiding WebSocket forwarding where it is not required.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-20, Red Hat Bugzilla documented CVE-2026-9595 in webpack-dev-server, describing information disclosure and denial-of-service risks when a broadly scoped proxy with `ws: true` intercepts HMR WebSocket traffic. The entry states the issue was fixed in webpack-dev-server version 5 and addressed in Red Hat Data Grid 8.6.2 via RHSA-2026:41951.
On 2026-07-20, Red Hat published advisory RHSA-2026:41951, rated Important, announcing Red Hat Data Grid 8.6.2 as a replacement for 8.6.1. The update included bug fixes, enhancements, and remediation for numerous vulnerabilities across bundled components including jackson-databind, React Router, Axios, Netty, Micrometer, OpenTelemetry Java, form-data, webpack-dev-server, and fast-uri.
On 2026-06-02, Red Hat published advisory RHSA-2026:22619, rated Important, announcing Red Hat Data Grid 8.6.1 as a replacement for 8.6.0. The update included bug fixes, enhancements, and fixes for multiple bundled-component vulnerabilities affecting Netty, Axios, Spring Boot, lodash, DOMPurify, and Apache Log4j.
On 2026-08-20, Red Hat published advisory RHSA-2026:57590. Related Bugzilla content states this advisory addresses CVE-2026-9595 in Red Hat Enterprise Linux 10.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **JBoss Enterprise Application Platform 8.1.6** as an **Important** security update for **RHEL 8** and **RHEL 9**, replacing version 8.1.5 and addressing a broad set of vulnerabilities in bundled components including **Bouncy Castle**, **Netty**, **Apache ActiveMQ Artemis**, **c3p0**, **mchange-commons-java**, **minimatch**, **WildFly Elytron**, and **plexus-utils**. The advisories cite risks including denial of service, request smuggling, LDAP injection, directory traversal, brute-force exposure, message injection and exfiltration, arbitrary code execution, private key leakage, and cryptographic implementation flaws. One of the tracked issues, **`CVE-2026-27904`**, affects the JavaScript glob-matching library **minimatch** and can cause denial of service through catastrophic backtracking in nested extglob expressions. Red Hat said the flaw was fixed across multiple products and included in the JBoss EAP updates, alongside other bundled-component remediations delivered through advisories **`RHSA-2026:18054`**, **`RHSA-2026:18055`**, and **`RHSA-2026:18059`**. Customers were advised to apply prior relevant errata, back up installations and data, and then upgrade to the fixed packages.
Aug 20, 2026
Red Hat released **JBoss Enterprise Application Platform 8.1.7** with an **Important** security update to remediate five vulnerabilities in bundled **Netty** components affecting JBoss EAP 8.1 deployments. The flaws can enable **denial of service**, **information disclosure and data manipulation**, **hostname verification bypass**, **insufficient bailiwick validation for NS records**, and an **IPv6 subnet rule bypass**, impacting JBoss EAP 8.1 on **RHEL 8, RHEL 9, and RHEL 10** for `x86_64` systems. The fixes were published in Red Hat advisories `RHSA-2026:49700` and `RHSA-2026:49701`, which update Netty in the JBoss EAP 8.1.z stream from `4.1.133.Final-redhat-00001` to `4.1.135.Final-redhat-00001`. Red Hat’s product documentation and release materials for JBoss EAP 8.1 accompany the release, while the advisories direct customers to ensure prerequisite errata are applied, back up existing installations, and deploy the updated packages.
Aug 20, 2026
Red Hat released Moderate-impact updates for Apache Tomcat, JBoss Web Server, JBoss EAP 6.2.4, and JBoss Data Grid to remediate **CVE-2014-0075**, **CVE-2014-0099**, and **CVE-2014-0096**. The flaws could permit remote denial of service through unbounded chunked-transfer input, HTTP request smuggling via integer overflow while parsing `Content-Length` headers—particularly where a vulnerable server sits behind a reverse proxy—and XML external entity (XXE) processing in Tomcat DefaultServlet handling of user-supplied XSLTs. JBoss EAP and Data Grid updates additionally addressed XML parser abuse that could bypass XXE restrictions and expose XML files belonging to other applications on the same instance. Affected RHEL 6 and 7 Tomcat deployments, JBoss Web Server 2.0.1 installations, and EAP 6.2.4 environments should install the applicable vendor packages or upgrades and restart Tomcat or the JBoss server process. Red Hat supplied patched builds including `tomcat-7.0.42-6.el7_0` for RHEL 7 and `tomcat6-6.0.24-72.el6_5` for RHEL 6; JBoss Data Grid 6.2.1 users were directed to upgrade to 6.3.0. Administrators should back up JBoss installations, applications, and configurations before applying updates, and prioritize externally reachable services deployed behind reverse proxies.
Aug 29, 2026