Skip to main content
CVE-2024-25710VulnerabilityPublished Updated

Red Hat Security Advisory: Red Hat Data Grid 8.4.7 security update

Affects Red HatSource GCVE Database

0

Mentioned vulnerabilities

Authoritative record:CVE-2024-25710· High 8.1

Not known to be exploited · CVSS 8.1 High : upgrade Red Hat to 1.21 soon.

Data as of 26 Oct 2026, 09:15 UTC

CVSS 3.1 base score
8.1High
How severe the flaw is on the 0–10 CVSS scale.
EPSS
0.4% chance of exploitation in 30 days – higher than 38% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch
Available – fixed in 1.21
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 19 Feb 2024

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponised: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

What to do

Upgrade org.apache.commons/commons-compress to 1.21.

Affected software

ProductAffectedFixed in
Mavenorg.apache.commons/commons-compresspkg:maven/org.apache.commons/commons-compressOther threatsAffected
  • <1.21
Fixed in
  • 1.21

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A security update to Red Hat Data Grid 8.4.7 is available and includes fixes for these vulnerabilities. Users should back up their existing installations and apply the update following Red Hat's official guidance. No additional mitigations are specified or required beyond applying the official patch.

Description

Red Hat Data Grid 8.4.7 addresses two moderate severity security vulnerabilities in the commons-compress library that could cause denial of service conditions. These issues involve an infinite loop triggered by a corrupted DUMP file and an OutOfMemoryError when unpacking a broken Pack200 file. The update replaces version 8.4.6 and includes these security fixes along with other bug fixes and enhancements.

References

Community reviews

Loading reviews…