← Vulnerability feed

Vulnerability record · CVE-2023-4586 · published 4 October 2023

CVE-2023-4586: Redhat data grid improper input validation vulnerability

Redhat · Data Grid

A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack.

7.4 CVSS 3.1 High EPSS 0.55% · top 56.3% CWE-20 · Improper input validationCWE-295 · Improper certificate validation
7.4CVSS 3.1 base score
0.55%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://access.redhat.com/errata/RHSA-2023:7676
https://access.redhat.com/security/cve/CVE-2023-4586 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2235564 Issue TrackingThird Party Advisory
https://access.redhat.com/errata/RHSA-2023:7676
https://access.redhat.com/security/cve/CVE-2023-4586 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2235564 Issue TrackingThird Party Advisory

Track CVE-2023-4586 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-31917Infinispan-server-rest improper authentication vulnerabilityA flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authenticat…EPSS 1.3%9.8CVE-2015-7501Red Hat JBoss Java deserialization allows remote command executionMultiple Red Hat JBoss products deserialize untrusted Java objects and, through the Apache Commons Collections library, allow remote attackers to exe…EPSS 86%analysed9.6CVE-2025-12543Redhat build of apache camel improper input validation vulnerabilityA flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to pr…EPSS 1.4%9.1CVE-2026-28369Redhat build of apache camel - hawtio http request smuggling vulnerabilityA flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly proce…EPSS 0.89%9.1CVE-2026-28367Redhat build of apache camel - hawtio http request smuggling vulnerabilityA flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for…EPSS 0.89%9.1CVE-2026-28368Redhat build of apache camel - hawtio http request smuggling vulnerabilityA flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed diffe…EPSS 0.89%8.1CVE-2026-16102Redhat build of keycloak improper access control vulnerabilityA flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy f…EPSS 0.46%8.1CVE-2026-15573Redhat build of keycloak vulnerabilityA flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does n…EPSS 0.46%

Source: NIST National Vulnerability Database (record CVE-2023-4586), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.