Red Hat JBoss Data Grid 7 vulnerabilities

14 CVEs affecting Red Hat JBoss Data Grid 7, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-3884, published 2025-12-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-5685, published 2024-03-22. High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days. A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled resource management…
CVE-2024-5971, published 2024-07-08. High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days. A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not…
CVE-2024-3653, published 2024-07-08. Medium severity, CVSS 5.3. EPSS: 1.9% chance of exploitation in the next 30 days. A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler…
CVE-2024-6162, published 2024-06-20. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode…
CVE-2024-1023, published 2024-03-27. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to…
CVE-2024-3884, published 2025-12-03. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding…
CVE-2023-4639, published 2024-11-17. High severity, CVSS 7.4. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to…
CVE-2024-1300, published 2024-04-02. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate…
CVE-2023-6717, published 2024-04-25. Medium severity, CVSS 6.0. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a…
CVE-2024-8447, published 2025-01-02. Medium severity, CVSS 5.9. EPSS: 0.7% chance of exploitation in the next 30 days. A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID…

Latest

CVE-2024-6875, published 2025-03-28. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability was found in the Infinispan component in Red Hat Data Grid. The REST compare API may have a buffer leak and an out of memory error can occur when sending continual requests with large…
CVE-2024-9622, published 2024-10-08. Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling request with an ASCII control character is…
CVE-2024-4029, published 2024-05-02. Medium severity, CVSS 4.1. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile…