Critical Security Update for JMC Package: Addressing Information Disclosure and HTTP Request Smuggling Vulnerabilities

jmc Updated 02 Jul 2026

Summary

26/05/2026

Disclosed on

N/A

Severity

Yes i

Fix available

Unrated

Severity

Not published

CVSS Score

ALSA-2026:20568: Important: jmc security update. Affects jmc versions < 8.2.0-19.el9_8.2. Fixed in 8.2.0-19.el9_8.2. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

JDK Mission Control (JMC) is a sophisticated profiling tool designed for HotSpot JVMs, providing developers and administrators with advanced capabilities for collecting and analyzing performance data from Java applications. It is particularly useful for optimizing application performance in both local and production environments. However, recent vulnerabilities have been identified that could compromise the security of applications utilizing this tool.

Vulnerability Detail

The vulnerabilities stem from two primary issues: 1) An information disclosure vulnerability in the lz4-java library due to insufficient output buffer clearing (CVE-2025-66566), which could allow unauthorized access to sensitive data. 2) An HTTP request smuggling vulnerability in the org.eclipse.jetty library, specifically related to chunked extension quoted-string parsing (CVE-2026-2332). Both vulnerabilities can lead to severe security risks, including data leaks and unauthorized access to application resources.

How To Fix

Minimum fixed version

8.2.0-19.el9_8.2

This is the first release that contains the fix.

sudo dnf update jmc

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

As a temporary workaround, users are advised to limit access to the affected components and monitor application logs for any suspicious activity until the package can be updated to the patched version.

Conclusion

In summary, the JMC package has critical vulnerabilities that require immediate attention. Users should update to the latest patched version to mitigate risks associated with information disclosure and HTTP request smuggling. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.

See every vulnerability recorded for jmc →