Red Hat Security Advisory: jmc security update
Red Hat has issued a security advisory for JDK Mission Control (jmc) addressing two vulnerabilities: an information disclosure issue in lz4-java due to insufficient output buffer clearing (CVE-2025-66566) and an HTTP request smuggling vulnerability in org.eclipse.jetty/jetty-http via chunked extension quoted-string parsing (CVE-2026-2332). These vulnerabilities affect Red Hat Enterprise Linux 9 CodeReady Linux Builder packages. The update is rated as Important by Red Hat Product Security. A fix is available and users are advised to apply the update.
AI Analysis
Technical Summary
The advisory covers two security issues in components used by JDK Mission Control on Red Hat Enterprise Linux 9. CVE-2025-66566 involves information disclosure caused by insufficient clearing of output buffers in lz4-java. CVE-2026-2332 is an HTTP request smuggling vulnerability in the jetty-http component, specifically related to parsing chunked extension quoted-strings. Red Hat has released updated packages for jmc (version 8.2.0-19.el9_8.2) that address these vulnerabilities. The advisory references Red Hat Bugzilla entries 2419500 and 2458187 for the respective CVEs. No CVSS scores are provided in the advisory, but the update is classified as Important.
Potential Impact
Successful exploitation of CVE-2025-66566 could lead to information disclosure due to improper buffer clearing. CVE-2026-2332 could allow HTTP request smuggling attacks, potentially impacting the integrity of HTTP communications. The advisory does not provide detailed impact scenarios or confirm active exploitation in the wild.
Mitigation Recommendations
A security update for jmc is available for Red Hat Enterprise Linux 9 CodeReady Linux Builder. Users should apply the update version jmc-8.2.0-19.el9_8.2 to remediate these vulnerabilities. Refer to Red Hat's official update instructions at https://access.redhat.com/articles/11258. No additional mitigation steps are specified or required beyond applying the update.
Red Hat Security Advisory: jmc security update
Description
Red Hat has issued a security advisory for JDK Mission Control (jmc) addressing two vulnerabilities: an information disclosure issue in lz4-java due to insufficient output buffer clearing (CVE-2025-66566) and an HTTP request smuggling vulnerability in org.eclipse.jetty/jetty-http via chunked extension quoted-string parsing (CVE-2026-2332). These vulnerabilities affect Red Hat Enterprise Linux 9 CodeReady Linux Builder packages. The update is rated as Important by Red Hat Product Security. A fix is available and users are advised to apply the update.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The advisory covers two security issues in components used by JDK Mission Control on Red Hat Enterprise Linux 9. CVE-2025-66566 involves information disclosure caused by insufficient clearing of output buffers in lz4-java. CVE-2026-2332 is an HTTP request smuggling vulnerability in the jetty-http component, specifically related to parsing chunked extension quoted-strings. Red Hat has released updated packages for jmc (version 8.2.0-19.el9_8.2) that address these vulnerabilities. The advisory references Red Hat Bugzilla entries 2419500 and 2458187 for the respective CVEs. No CVSS scores are provided in the advisory, but the update is classified as Important.
Potential Impact
Successful exploitation of CVE-2025-66566 could lead to information disclosure due to improper buffer clearing. CVE-2026-2332 could allow HTTP request smuggling attacks, potentially impacting the integrity of HTTP communications. The advisory does not provide detailed impact scenarios or confirm active exploitation in the wild.
Mitigation Recommendations
A security update for jmc is available for Red Hat Enterprise Linux 9 CodeReady Linux Builder. Users should apply the update version jmc-8.2.0-19.el9_8.2 to remediate these vulnerabilities. Refer to Red Hat's official update instructions at https://access.redhat.com/articles/11258. No additional mitigation steps are specified or required beyond applying the update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:20568
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-2332"]
- Cvss Version
- null
Threat ID: 6a16097be29bf47b506476df
Added to database: 05/26/2026, 20:58:35 UTC
Last enriched: 07/30/2026, 09:30:16 UTC
Last updated: 07/31/2026, 19:22:56 UTC
Views: 69
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.