Red Hat Product Errata RHSA-2026:69296 - Security Advisory
Issued:
2026-09-21
Updated:
2026-09-21

RHSA-2026:69296 - Security Advisory

Synopsis

Important: Red Hat Data Grid 8.6.3 security update

Type/Severity

Security Advisory: Important

Topic

An update for Red Hat Data Grid 8 is now available.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Data Grid is an in-memory, distributed, NoSQL datastore solution. It increases application response times and allows for dramatically improving performance while providing availability, reliability, and elastic scale.

Data Grid 8.6.3 replaces Data Grid 8.6.2 and includes bug fixes and enhancements. Find out more about Data Grid 8.6.3 in the Release Notes[3].

Security Fix(es):

  • CVE-2026-68494 jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser [jdg-8.6] (CVE-2026-68494)
  • CVE-2026-56745 datagrid-8/datagrid-8: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [jdg-8.6] (CVE-2026-56745)
  • CVE-2026-62243 netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration [jdg-8.6] (CVE-2026-62243)
  • CVE-2026-73508 netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names [jdg-8.6] (CVE-2026-73508)
  • CVE-2026-49978 dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution [jdg-8.6] (CVE-2026-49978)
  • CVE-2026-76844 redhat-datagrid-maven-repository.zip: webpack-dev-middleware: Information Disclosure via Path Traversal [jdg-8.6] (CVE-2026-76844)
  • CVE-2026-59901 netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2) [jdg-8.6] (CVE-2026-59901)
  • CVE-2026-59899 netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) [jdg-8.6] (CVE-2026-59899)
  • CVE-2026-56820 netty-handler-ssl-ocsp: Netty: Certificate revocation bypass via OCSP response replay attack [jdg-8.6] (CVE-2026-56820)
  • CVE-2026-56819 netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak [jdg-8.6] (CVE-2026-56819)
  • CVE-2026-56817 netty-codec-xml: Netty: Information disclosure via XML External Entity (XXE) vulnerability [jdg-8.6] (CVE-2026-56817)
  • CVE-2026-56746 netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header [jdg-8.6] (CVE-2026-56746)
  • CVE-2026-55851 netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message [jdg-8.6] (CVE-2026-55851)
  • CVE-2026-55831 netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing [jdg-8.6] (CVE-2026-55831)
  • CVE-2026-55833 netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification [jdg-8.6] (CVE-2026-55833)
  • CVE-2026-44891 netty-codec-stomp: Netty: Denial of Service vulnerability in STOMP decoder [jdg-8.6] (CVE-2026-44891)
  • CVE-2026-59296 micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing [jdg-8.6] (CVE-2026-59296)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

Affected Products

  • Red Hat JBoss Data Grid 8 x86_64

Fixes

  • BZ - 2500695 - CVE-2026-49978 dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
  • BZ - 2501958 - CVE-2026-44891 io.netty/netty-codec-stomp: Netty: Denial of Service vulnerability in STOMP decoder
  • BZ - 2503101 - CVE-2026-55833 netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification
  • BZ - 2503103 - CVE-2026-55831 io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing
  • BZ - 2505422 - CVE-2026-56746 io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header
  • BZ - 2505698 - CVE-2026-55851 io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message
  • BZ - 2505911 - CVE-2026-56745 netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec
  • BZ - 2505975 - CVE-2026-56817 io.netty/netty-codec-xml: Netty: Information disclosure via XML External Entity (XXE) vulnerability
  • BZ - 2505980 - CVE-2026-56819 io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak
  • BZ - 2505982 - CVE-2026-56820 io.netty/netty-handler-ssl-ocsp: Netty: Certificate revocation bypass via OCSP response replay attack
  • BZ - 2507481 - CVE-2026-59901 io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)
  • BZ - 2507482 - CVE-2026-59899 io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)
  • BZ - 2511026 - CVE-2026-68494 com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser
  • BZ - 2515377 - CVE-2026-73508 io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names
  • BZ - 2520949 - CVE-2026-59296 io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing
  • BZ - 2521309 - CVE-2026-62243 io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration
  • BZ - 2521896 - CVE-2026-76844 webpack-dev-middleware: webpack-dev-middleware: Information Disclosure via Path Traversal

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.