Red Hat Security Advisory: jmc security update
This advisory addresses security vulnerabilities in JDK Mission Control (jmc) for Red Hat Enterprise Linux 9. The update fixes two issues: an information disclosure vulnerability in lz4-java due to insufficient output buffer clearing (CVE-2025-66566), and an HTTP request smuggling vulnerability in org. eclipse. jetty/jetty-http related to chunked extension quoted-string parsing (CVE-2026-2332). Red Hat has released updated packages to remediate these vulnerabilities. The security impact is rated as Important by Red Hat Product Security. No CVSS scores are provided in the advisory. Users of affected Red Hat CodeReady Linux Builder versions are advised to apply the update as detailed in the Red Hat article referenced.
AI Analysis
Technical Summary
JDK Mission Control (jmc) is a profiling tool for HotSpot JVMs used to analyze data collected by JDK Flight Recorder. Two security vulnerabilities have been identified and fixed in the jmc packages for Red Hat Enterprise Linux 9. The first vulnerability (CVE-2025-66566) involves information disclosure caused by insufficient clearing of output buffers in the lz4-java library. The second vulnerability (CVE-2026-2332) is an HTTP request smuggling issue in the org.eclipse.jetty/jetty-http component due to improper parsing of chunked extension quoted-strings. Red Hat has issued an update (RHSA-2026:20568) that addresses these issues. The advisory does not provide CVSS scores but rates the impact as Important.
Potential Impact
The vulnerabilities could allow information disclosure through improper buffer clearing and enable HTTP request smuggling attacks, potentially impacting the confidentiality and integrity of Java applications using JDK Mission Control on affected Red Hat Enterprise Linux 9 systems. Red Hat rates the security impact as Important, indicating a significant risk if unpatched. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released updated jmc packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:20568 and the referenced article https://access.redhat.com/articles/11258. Since this is not a cloud service, remediation requires manual patching by system administrators. No additional mitigation steps are indicated by the vendor.
Red Hat Security Advisory: jmc security update
Description
This advisory addresses security vulnerabilities in JDK Mission Control (jmc) for Red Hat Enterprise Linux 9. The update fixes two issues: an information disclosure vulnerability in lz4-java due to insufficient output buffer clearing (CVE-2025-66566), and an HTTP request smuggling vulnerability in org. eclipse. jetty/jetty-http related to chunked extension quoted-string parsing (CVE-2026-2332). Red Hat has released updated packages to remediate these vulnerabilities. The security impact is rated as Important by Red Hat Product Security. No CVSS scores are provided in the advisory. Users of affected Red Hat CodeReady Linux Builder versions are advised to apply the update as detailed in the Red Hat article referenced.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
JDK Mission Control (jmc) is a profiling tool for HotSpot JVMs used to analyze data collected by JDK Flight Recorder. Two security vulnerabilities have been identified and fixed in the jmc packages for Red Hat Enterprise Linux 9. The first vulnerability (CVE-2025-66566) involves information disclosure caused by insufficient clearing of output buffers in the lz4-java library. The second vulnerability (CVE-2026-2332) is an HTTP request smuggling issue in the org.eclipse.jetty/jetty-http component due to improper parsing of chunked extension quoted-strings. Red Hat has issued an update (RHSA-2026:20568) that addresses these issues. The advisory does not provide CVSS scores but rates the impact as Important.
Potential Impact
The vulnerabilities could allow information disclosure through improper buffer clearing and enable HTTP request smuggling attacks, potentially impacting the confidentiality and integrity of Java applications using JDK Mission Control on affected Red Hat Enterprise Linux 9 systems. Red Hat rates the security impact as Important, indicating a significant risk if unpatched. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released updated jmc packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:20568 and the referenced article https://access.redhat.com/articles/11258. Since this is not a cloud service, remediation requires manual patching by system administrators. No additional mitigation steps are indicated by the vendor.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:20568
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-2332"]
- Cvss Version
- null
Threat ID: 6a16097be29bf47b506476df
Added to database: 5/26/2026, 8:58:35 PM
Last enriched: 5/26/2026, 11:05:50 PM
Last updated: 5/27/2026, 5:01:14 AM
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.