Red Hat Data Grid 8.5.0 addresses two security vulnerabilities: CVE-2024-29180 involves a lack of URL validation in webpack-dev-middleware that may allow file leaks, and CVE-2024-29025 concerns resource allocation without limits or throttling in netty-codec-http, potentially leading to resource exhaustion. These vulnerabilities affect Red Hat JBoss Data Grid 8 and were fixed in the 8.5.0 release, which replaces version 8.4.8. The advisory does not provide CVSS scores but classifies the update as Important. The vendor advisory recommends applying the update after ensuring all previous errata are applied.

The vulnerabilities could allow unauthorized file leaks due to insufficient URL validation and potential resource exhaustion due to unbounded resource allocation. These issues may impact the availability and confidentiality of the affected system. The vendor rates the security impact as Important, indicating a significant but not critical risk. No known exploits in the wild have been reported.

Apply the Red Hat Data Grid 8.5.0 update, which includes fixes for these vulnerabilities. Before applying this update, ensure all previously released errata relevant to your system have been applied. Follow Red Hat's official guidance for applying updates at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.