Critical Security Update for JMC: Addressing Information Disclosure and HTTP Request Smuggling Vulnerabilities
Summary
RLSA-2026:20568: Important: jmc security update. Affects jmc versions < 0:8.2.0-19.el9_8.2. Fixed in 0:8.2.0-19.el9_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JDK Mission Control (JMC) is a sophisticated profiling tool designed for HotSpot JVMs, providing developers and administrators with advanced capabilities for collecting and analyzing extensive data from Java applications. JMC enables efficient performance monitoring and troubleshooting, making it essential for applications running in both local and production environments. However, recent vulnerabilities have been identified that could compromise the security of applications utilizing this tool.
Vulnerability Detail
The vulnerabilities identified in JMC stem from two main issues: 1) Information Disclosure via Insufficient Output Buffer Clearing in lz4-java (CVE-2025-66566), which could allow unauthorized access to sensitive information, and 2) HTTP request smuggling via chunked extension quoted-string parsing in org.eclipse.jetty/jetty-http (CVE-2026-2332), which could lead to malicious exploitation of HTTP requests. Both vulnerabilities pose significant risks, potentially allowing attackers to access confidential data or manipulate HTTP traffic.
How To Fix
Minimum fixed version
0:8.2.0-19.el9_8.2
This is the first release that contains the fix.
sudo dnf update jmcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider limiting access to the JMC tool and monitoring network traffic to detect any unusual activity until the package can be updated.
Conclusion
The recent vulnerabilities in JDK Mission Control highlight critical security concerns that need to be addressed promptly. By updating to the latest patched version, users can mitigate the risks associated with information disclosure and HTTP request smuggling. Regular monitoring and using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for jmc →
FAQ
JDK Mission Control is a profiling tool for HotSpot JVMs that helps in analyzing performance data from Java applications.
The vulnerabilities include information disclosure due to insufficient output buffer clearing and HTTP request smuggling.
You can use the Vulert playground at Vulert Scanner to check if your application is impacted without needing to sign up.
The CVSS score for these vulnerabilities is 7.5, indicating a high level of severity.
You can update the JMC package by running 'sudo dnf update jmc' in your terminal.
Related vulnerabilities
Recent vulnerabilities recorded for jmc.
