RHSA-2026:41951

Details:

Red Hat Data Grid is an in-memory, distributed, NoSQL datastore solution. It increases application response times and allows for dramatically improving performance while providing availability, reliability, and elastic scale.

Data Grid 8.6.2 replaces Data Grid 8.6.1 and includes bug fixes and enhancements. Find out more about Data Grid 8.6.2 in the Release Notes[3].

Security Fix(es):

• CVE-2026-54513 jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution [jdg-8.6] (CVE-2026-54513)

• CVE-2026-42211 react-router: React Router: Remote Code Execution via prototype pollution in Framework Mode [jdg-8.6] (CVE-2026-42211)

• CVE-2026-42264 axios: Axios: Prototype pollution allows information disclosure and request manipulation [jdg-8.6] (CVE-2026-42264)

• CVE-2026-50193 jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing [jdg-8.6] (CVE-2026-50193)

• CVE-2026-54512 jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass [jdg-8.6] (CVE-2026-54512)

• CVE-2026-40983 micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests [jdg-8.6] (CVE-2026-40983)

• CVE-2026-40984 micrometer-core: Micrometer: Denial of Service via specially crafted HTTP requests [jdg-8.6] (CVE-2026-40984)

• CVE-2026-12143 form-data: form-data: Form field override via CRLF injection [jdg-8.6] (CVE-2026-12143)

• CVE-2026-9595 webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration [jdg-8.6] (CVE-2026-9595)

• CVE-2026-50011 netty-codec-redis: Netty: Denial of Service via malicious Redis array header [jdg-8.6] (CVE-2026-50011)

• CVE-2026-45416 netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake [jdg-8.6] (CVE-2026-45416)

• CVE-2026-44890 netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads [jdg-8.6] (CVE-2026-44890)

• CVE-2026-44250...