Red Hat Data Grid 8.5.0 is a security update that fixes two vulnerabilities: CVE-2024-29180, which is a lack of URL validation in webpack-dev-middleware potentially leading to file leaks, and CVE-2024-29025, which involves allocation of resources without limits or throttling in netty-codec-http. These vulnerabilities could impact the security and stability of the Data Grid service by exposing files or causing resource exhaustion. The update replaces version 8.4.8 and includes these fixes. Red Hat classifies the update as important and advises users to apply it following the application of all prior relevant errata. No CVSS scores are provided in the advisory, and no known exploits have been reported.

The vulnerabilities could allow unauthorized file disclosure due to insufficient URL validation and potential denial of service or resource exhaustion due to uncontrolled resource allocation. These impacts could degrade service availability or confidentiality of data stored in Red Hat Data Grid prior to version 8.5.0. However, there are no known exploits in the wild currently reported for these issues.

Red Hat has released Data Grid version 8.5.0 which includes fixes for these vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigations are specified or required beyond applying the official update.