Red Hat Data Grid vulnerabilities

25 CVEs affecting Red Hat Data Grid, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-16102, published 2026-08-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-7501, published 2017-11-09. Critical severity, CVSS 9.8. EPSS: 85.6% chance of exploitation in the next 30 days. Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service…
CVE-2024-7885, published 2024-08-21. High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days. A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method…
CVE-2020-25644, published 2020-10-06. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest…
CVE-2021-31917, published 2021-09-21. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all REST endpoints when DIGEST is used as…
CVE-2025-12543, published 2026-01-07. Critical severity, CVSS 9.6. EPSS: 1.3% chance of exploitation in the next 30 days. A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP…
CVE-2019-14838, published 2019-10-14. Medium severity, CVSS 4.9. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server
CVE-2023-5236, published 2023-12-18. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed…
CVE-2020-25711, published 2020-12-03. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can…
CVE-2026-44495, published 2026-06-11. High severity, CVSS 7.7. EPSS: 1% chance of exploitation in the next 30 days. Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another…
CVE-2026-28367, published 2026-03-27. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers,…

Latest

CVE-2026-16102, published 2026-08-05. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User…
CVE-2026-15573, published 2026-08-05. High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By…
CVE-2026-16093, published 2026-07-17. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this…
CVE-2026-15945, published 2026-07-16. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access…
CVE-2026-28369, published 2026-03-27. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading…
CVE-2026-28368, published 2026-03-27. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies.…
CVE-2025-5731, published 2025-06-26. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an…