CompaniesJiraMonthly reportsJune 2026
Jira in June 2026: incidents, uptime and changes
7incidents posted
4labelled major or critical
76.39%free of major/critical
75.84%free of any incident
0price changes
0notable page changes
Vendor-reported outage time 7.1 days, incident time 7.2 days. Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours. Last 90 days.
By vendor label: Major 4 · Minor 3
Major and critical incidents 4
| Incident | Impact | Started | Duration | Status | Day |
|---|---|---|---|---|---|
| For Jira-software viewIssues and viewBoard are degraded | Major | 5.7 h | postmortem | 06-01 | |
| Users experiencing issues loading work items in Atlassian products | Major | 51 min | resolved | 06-06 | |
| Some users experiencing issues viewing boards and work items | Major | 13 h | resolved | 06-09 | |
| Jira : Incoming emails partial outage | Major | 6 d | resolved | 06-19 |
Other incidents 3
| Incident | Impact | Started | Duration | Status | Day |
|---|---|---|---|---|---|
| Degraded performance of Jira and JSM automations in US East | Minor | 1.3 h | resolved | 06-02 | |
| Users experiencing issues loading work items in Jira and JSM | Minor | 1.1 h | resolved | 06-08 | |
| Delays in processing incoming Emails, Work Item notifications, and Scheduled Triggers in Marketplace Apps | Minor | 1.6 h | resolved | 06-10 |
CVEs published
- CVE-2026-34077 React Router vulnerable to Denial of Service via reflected user input in single-fetch (CVSS 7.5)
- CVE-2026-42211 React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE (CVSS 8.1)
- CVE-2026-42342 React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint (CVSS 7.5)
- CVE-2026-40983 Micrometer gRPC server instrumentation DoS vulnerability (CVSS 7.5)
- CVE-2026-41842 Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux (CVSS 7.5)
- CVE-2026-41845 Spring Framework Cross-site Scripting via JavaScriptUtils (CVSS 7.1)
- CVE-2026-47838 Unauthorized User Impersonation when Using X.509 Client Certificates (CVSS 6.8)
- CVE-2026-46625 JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection (CVSS 7.5)
- CVE-2026-44492 Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718) (CVSS 8.6)
- CVE-2026-44494 Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` (CVSS 8.7)
- CVE-2026-44495 Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge (CVSS 7.0)
- CVE-2026-44496 Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection (CVSS 7.5)
- CVE-2026-44490 Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions (CVSS 4.8)
- CVE-2026-44488 Axios: Allocation of Resources Without Limits or Throttling in axios (CVSS 7.5)
- CVE-2026-44487 Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter (CVSS 7.5)
- CVE-2026-44486 Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection (CVSS 7.5)
- CVE-2026-44705 tmp: Path Traversal via unsanitized prefix/postfix enables directory escape (CVSS 8.2)
- CVE-2026-44249 Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking (CVSS 8.1)
- CVE-2026-45416 Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes (CVSS 7.5)
- CVE-2026-48043 netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion (CVSS 5.3)
- CVE-2026-50010 Netty's wrapping plain trust manager silently disables hostname verification (CVSS 7.5)
- CVE-2026-12143 form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) (CVSS 7.5)
- CVE-2026-12151 undici WebSocket client vulnerable to denial of service via fragment count bypass (CVSS 7.5)
- CVE-2026-54513 jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) (CVSS 8.1)
- CVE-2026-54512 jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation (CVSS 8.1)
- CVE-2026-13676 fast-uri vulnerable to host confusion via failed IDN canonicalization (CVSS 7.5)
- CVE-2026-53404 Apache Tomcat: Bad ornext processing in RewriteValve (CVSS 7.3)
- CVE-2026-53434 Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector (CVSS 9.1)
- CVE-2026-55276 Apache Tomcat: Logged effective web.xml is incomplete (CVSS 9.1)
- CVE-2026-13149 (CVSS 7.7)
Cite this
Jira posted 7 status incidents in June 2026 (4 major or critical); 0 price changes and 0 notable page changes observed.
- Title
- Jira in June 2026
- Vendor
- Jira
- Date
- URL
- https://rewindex.com/company/jira/2026/06