Red Hat Security Advisory: Red Hat Data Grid 8.6.1 security update
Red Hat Data Grid is an in-memory, distributed, NoSQL datastore solution. It increases application response times and allows for dramatically improving performance while providing availability, reliability, and elastic scale. Data Grid 8.6.1 replaces Data Grid 8.6.0 and includes bug fixes and enhancements. Find out more about Data Grid 8.6.1 in the Release Notes[3]. Security Fix(es): * CVE-2026-33871 netty-codec-http: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood [jdg-8] (CVE-2026-33871) * CVE-2026-33870 netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values [jdg-8] (CVE-2026-33870) * CVE-2026-42043 axios: Axios: NO_PROXY bypass via crafted URL [jdg-8] (CVE-2026-42043) * CVE-2026-42041 axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling [jdg-8.6] (CVE-2026-42041) * CVE-2026-42039 axios: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data [jdg-8.6] (CVE-2026-42039) * CVE-2026-42033 axios: Axios: HTTP Transport Hijacking via Prototype Pollution [jdg-8.6] (CVE-2026-42033) * CVE-2026-40975 spring-boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure. [jdg-8.6] (CVE-2026-40975) * CVE-2026-4800 lodash: lodash: Arbitrary code execution via untrusted input in template imports [jdg-8.6] (CVE-2026-4800) * CVE-2026-41240 dompurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization [jdg-8.6] (CVE-2026-41240) * CVE-2026-34481 log4j-layout-template-json: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output [jdg-8.6] (CVE-2026-34481) * CVE-2026-34480 log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging [jdg-8.6] (CVE-2026-34480) * CVE-2026-34478 log4j-core-test: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames [jdg-8.6] (CVE-2026-34478) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
Red Hat OpenShift Container Platform 4.16.66 is a security and bug fix update that addresses several vulnerabilities, including CVE-2026-4800 and others, affecting the Kubernetes application platform for on-premise or private cloud deployments. The advisory covers updated container images and references a separate advisory for RPM package updates. The update is classified as Important by Red Hat, with no detailed CVSS scores provided. The advisory directs users to upgrade their clusters using official documentation and tools to fully apply the asynchronous errata update.
Potential Impact
The update addresses multiple security vulnerabilities and bugs in OpenShift Container Platform 4.16, which could potentially impact the confidentiality, integrity, or availability of the platform if left unpatched. The severity is rated as Important by Red Hat, indicating a high impact but not critical. No known exploits in the wild have been reported at the time of this advisory.
Mitigation Recommendations
Red Hat OpenShift Container Platform 4.16 users should upgrade to version 4.16.66 by applying the updated container images and RPM packages as provided in the official Red Hat advisories. Detailed upgrade instructions are available in the Red Hat documentation. Since this is an official fix, applying the update fully mitigates the addressed vulnerabilities.
Red Hat Security Advisory: Red Hat Data Grid 8.6.1 security update
Description
Red Hat Data Grid is an in-memory, distributed, NoSQL datastore solution. It increases application response times and allows for dramatically improving performance while providing availability, reliability, and elastic scale. Data Grid 8.6.1 replaces Data Grid 8.6.0 and includes bug fixes and enhancements. Find out more about Data Grid 8.6.1 in the Release Notes[3]. Security Fix(es): * CVE-2026-33871 netty-codec-http: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood [jdg-8] (CVE-2026-33871) * CVE-2026-33870 netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values [jdg-8] (CVE-2026-33870) * CVE-2026-42043 axios: Axios: NO_PROXY bypass via crafted URL [jdg-8] (CVE-2026-42043) * CVE-2026-42041 axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling [jdg-8.6] (CVE-2026-42041) * CVE-2026-42039 axios: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data [jdg-8.6] (CVE-2026-42039) * CVE-2026-42033 axios: Axios: HTTP Transport Hijacking via Prototype Pollution [jdg-8.6] (CVE-2026-42033) * CVE-2026-40975 spring-boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure. [jdg-8.6] (CVE-2026-40975) * CVE-2026-4800 lodash: lodash: Arbitrary code execution via untrusted input in template imports [jdg-8.6] (CVE-2026-4800) * CVE-2026-41240 dompurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization [jdg-8.6] (CVE-2026-41240) * CVE-2026-34481 log4j-layout-template-json: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output [jdg-8.6] (CVE-2026-34481) * CVE-2026-34480 log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging [jdg-8.6] (CVE-2026-34480) * CVE-2026-34478 log4j-core-test: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames [jdg-8.6] (CVE-2026-34478) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat OpenShift Container Platform 4.16.66 is a security and bug fix update that addresses several vulnerabilities, including CVE-2026-4800 and others, affecting the Kubernetes application platform for on-premise or private cloud deployments. The advisory covers updated container images and references a separate advisory for RPM package updates. The update is classified as Important by Red Hat, with no detailed CVSS scores provided. The advisory directs users to upgrade their clusters using official documentation and tools to fully apply the asynchronous errata update.
Potential Impact
The update addresses multiple security vulnerabilities and bugs in OpenShift Container Platform 4.16, which could potentially impact the confidentiality, integrity, or availability of the platform if left unpatched. The severity is rated as Important by Red Hat, indicating a high impact but not critical. No known exploits in the wild have been reported at the time of this advisory.
Mitigation Recommendations
Red Hat OpenShift Container Platform 4.16 users should upgrade to version 4.16.66 by applying the updated container images and RPM packages as provided in the official Red Hat advisories. Detailed upgrade instructions are available in the Red Hat documentation. Since this is an official fix, applying the update fully mitigates the addressed vulnerabilities.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:8498
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-30951"]
- Cvss Version
- null
Threat ID: 6a160973e29bf47b5063cc8c
Added to database: 05/26/2026, 20:58:27 UTC
Last enriched: 07/26/2026, 01:34:25 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 97
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.