Skip to content
OpenAdvisories

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

Affected products

VendorProductAffectedFixed
Oracle Java SE JDK and JRE Oracle Java SE:8u401, Oracle Java SE:8u401-perf, Oracle Java SE:11.0.22, Oracle GraalVM Enterprise Edition:20.3.13, Oracle GraalVM Enterprise Edition:21.3.9 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 11 openjdk-11 11.0.23+9-1~deb11u1 DSA-5671-1
Debian 10 openjdk-11 11.0.23+9-1~deb10u1 DLA-3793-1
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS openjdk-8 8u412-ga-1~24.04.2 USN-7096-1, USN-6810-1
Ubuntu 22.04 LTS openjdk-18 No fix yet —
Ubuntu 22.04 LTS openjdk-8 8u412-ga-1~22.04.1 USN-7096-1, USN-6810-1
Ubuntu 22.04 LTS openjdk-lts 11.0.23+9-1ubuntu1~22.04.1 USN-6811-1
Ubuntu 20.04 LTS openjdk-13 +1 No fix yet —
Ubuntu 20.04 LTS openjdk-8 8u412-ga-1~20.04.1 USN-7096-1, USN-6810-1
Ubuntu 20.04 LTS openjdk-lts 11.0.23+9-1ubuntu1~20.04.2 USN-6811-1
Ubuntu 16.04 LTS openjdk-9 No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS openjdk-8 8u412-ga-1~18.04.1 USN-7096-1, USN-6810-1
Ubuntu Pro 18.04 LTS openjdk-lts 11.0.23+9-1ubuntu1~18.04.1 USN-6811-1
Ubuntu Pro 16.04 LTS openjdk-8 8u432-ga~us1-0ubuntu2~16.04.4 USN-7096-1
ReleasePackageFixed inAdvisory
RHEL 9 java-1.8.0-openjdk +16 1:1.8.0.412.b08-2.el9 RHSA-2024:1818
RHEL 9 java-11-openjdk +22 1:11.0.23.0.9-3.el9 RHSA-2024:1822
RHEL 8 java-1.8.0-openjdk +19 1:1.8.0.412.b08-2.el8 RHSA-2024:1818
RHEL 8 java-11-openjdk +22 1:11.0.23.0.9-3.el8 RHSA-2024:1822
RHEL 7 java-1.8.0-openjdk +7 1:1.8.0.412.b08-1.el7_9 RHSA-2024:1817
RHEL 7 java-11-openjdk +8 1:11.0.23.0.9-2.el7_9 RHSA-2024:1821
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.2 EUS java-1.8.0-openjdk +16 1:1.8.0.412.b08-2.el9 RHSA-2024:1818
RHEL 9.2 EUS java-11-openjdk +22 1:11.0.23.0.9-3.el9 RHSA-2024:1822
RHEL 9.0 EUS java-1.8.0-openjdk +16 1:1.8.0.412.b08-1.el9_0 RHSA-2024:1818
RHEL 9.0 EUS java-11-openjdk +22 1:11.0.23.0.9-2.el9_0 RHSA-2024:1822
RHEL 8.8 EUS java-1.8.0-openjdk +19 1:1.8.0.412.b08-2.el8 RHSA-2024:1818
RHEL 8.8 EUS java-11-openjdk +22 1:11.0.23.0.9-3.el8 RHSA-2024:1822
RHEL 8.6 EUS java-1.8.0-openjdk +19 1:1.8.0.412.b08-1.el8_6 RHSA-2024:1818
RHEL 8.6 EUS java-11-openjdk +22 1:11.0.23.0.9-2.el8_6 RHSA-2024:1822
RHEL 8.4 TUS java-1.8.0-openjdk +7 1:1.8.0.412.b08-1.el8_4 RHSA-2024:1818
RHEL 8.4 TUS java-11-openjdk +8 1:11.0.23.0.9-2.el8_4 RHSA-2024:1822
RHEL 8.4 E4S java-1.8.0-openjdk +7 1:1.8.0.412.b08-1.el8_4 RHSA-2024:1818
RHEL 8.4 E4S java-11-openjdk +8 1:11.0.23.0.9-2.el8_4 RHSA-2024:1822
RHEL 8.4 AUS java-1.8.0-openjdk +7 1:1.8.0.412.b08-1.el8_4 RHSA-2024:1818
RHEL 8.4 AUS java-11-openjdk +8 1:11.0.23.0.9-2.el8_4 RHSA-2024:1822
RHEL 8.2 TUS java-1.8.0-openjdk +7 1:1.8.0.412.b08-1.el8_2 RHSA-2024:1818
RHEL 8.2 TUS java-11-openjdk +8 1:11.0.23.0.9-2.el8_2 RHSA-2024:1822
RHEL 8.2 E4S java-1.8.0-openjdk +7 1:1.8.0.412.b08-1.el8_2 RHSA-2024:1818
RHEL 8.2 E4S java-11-openjdk +8 1:11.0.23.0.9-2.el8_2 RHSA-2024:1822
RHEL 8.2 AUS java-1.8.0-openjdk +7 1:1.8.0.412.b08-1.el8_2 RHSA-2024:1818
RHEL 8.2 AUS java-11-openjdk +8 1:11.0.23.0.9-2.el8_2 RHSA-2024:1822

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 java-1.8.0-openjdk +16 1:1.8.0.412.b08-2.el9 ALSA-2024:1818
AlmaLinux 9 java-11-openjdk +22 1:11.0.23.0.9-3.el9 ALSA-2024:1822
AlmaLinux 8 java-1.8.0-openjdk +19 1:1.8.0.412.b08-2.el8 ALSA-2024:1818
AlmaLinux 8 java-11-openjdk +22 1:11.0.23.0.9-3.el8 ALSA-2024:1822

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 java-1.8.0-openjdk 1:1.8.0.412.b08-2.el9 RLSA-2024:1818
Rocky Linux 9 java-11-openjdk 1:11.0.23.0.9-3.el9 RLSA-2024:1822
Rocky Linux 8 java-1.8.0-openjdk 1:1.8.0.412.b08-2.el8 RLSA-2024:1818
Rocky Linux 8 java-11-openjdk 1:11.0.23.0.9-3.el8 RLSA-2024:1822
ReleasePackageFixed inAdvisory
SLES 15 SP6 java-11-openjdk 11.0.23.0-150000.3.113.1 SUSE-SU-2024:1498-2
SLES 15 SP6 java-1_8_0-ibm 1.8.0_sr8.25-150000.3.89.1 SUSE-SU-2024:1859-1
SLES 15 SP6 java-1_8_0-openj9 1.8.0.412-150200.3.45.2 SUSE-SU-2024:1793-1
SLES 15 SP5 java-11-openjdk 11.0.23.0-150000.3.113.1 SUSE-SU-2024:1498-1
SLES 15 SP5 java-1_8_0-ibm 1.8.0_sr8.25-150000.3.89.1 SUSE-SU-2024:1859-1
SLES 15 SP5 java-1_8_0-openj9 1.8.0.412-150200.3.45.2 SUSE-SU-2024:1793-1
SLES 15 SP5 java-1_8_0-openjdk 1.8.0.412-150000.3.91.1 SUSE-SU-2024:1451-1
SLES 15 SP4 java-11-openjdk 11.0.23.0-150000.3.113.1 SUSE-SU-2024:1498-1
SLES 15 SP4 java-1_8_0-ibm 1.8.0_sr8.25-150000.3.89.1 SUSE-SU-2024:1859-1
SLES 15 SP4 java-1_8_0-openjdk 1.8.0.412-150000.3.91.1 SUSE-SU-2024:1451-1
SLES 15 SP3 java-11-openjdk 11.0.23.0-150000.3.113.1 SUSE-SU-2024:1498-1
SLES 15 SP3 java-1_8_0-ibm 1.8.0_sr8.25-150000.3.89.1 SUSE-SU-2024:1859-1
SLES 15 SP3 java-1_8_0-openjdk 1.8.0.412-150000.3.91.1 SUSE-SU-2024:1451-1
SLES 15 SP2 java-11-openjdk 11.0.23.0-150000.3.113.1 SUSE-SU-2024:1498-1
SLES 15 SP2 java-1_8_0-ibm 1.8.0_sr8.25-150000.3.89.1 SUSE-SU-2024:1859-1
SLES 15 SP2 java-1_8_0-openjdk 1.8.0.412-150000.3.91.1 SUSE-SU-2024:1451-1
Show 12 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP5 java-11-openjdk 11.0.23.0-3.75.1 SUSE-SU-2024:1452-1
SLES 12 SP5 java-1_8_0-ibm 1.8.0_sr8.25-30.123.1 SUSE-SU-2024:1845-1
SLES 12 SP5 java-1_8_0-openjdk 1.8.0.412-27.99.1 SUSE-SU-2024:1450-1
SLES for SAP 15 SP4 java-11-openjdk 11.0.23.0-150000.3.113.1 SUSE-SU-2024:1498-1
SLES for SAP 15 SP4 java-1_8_0-ibm 1.8.0_sr8.25-150000.3.89.1 SUSE-SU-2024:1859-1
SLES for SAP 15 SP4 java-1_8_0-openjdk 1.8.0.412-150000.3.91.1 SUSE-SU-2024:1451-1
SLES for SAP 15 SP3 java-11-openjdk 11.0.23.0-150000.3.113.1 SUSE-SU-2024:1498-1
SLES for SAP 15 SP3 java-1_8_0-ibm 1.8.0_sr8.25-150000.3.89.1 SUSE-SU-2024:1859-1
SLES for SAP 15 SP3 java-1_8_0-openjdk 1.8.0.412-150000.3.91.1 SUSE-SU-2024:1451-1
SLES for SAP 15 SP2 java-11-openjdk 11.0.23.0-150000.3.113.1 SUSE-SU-2024:1498-1
SLES for SAP 15 SP2 java-1_8_0-ibm 1.8.0_sr8.25-150000.3.89.1 SUSE-SU-2024:1859-1
SLES for SAP 15 SP2 java-1_8_0-openjdk 1.8.0.412-150000.3.91.1 SUSE-SU-2024:1451-1
SLES for SAP 12 SP5 java-11-openjdk 11.0.23.0-3.75.1 SUSE-SU-2024:1452-1
SLES for SAP 12 SP5 java-1_8_0-ibm 1.8.0_sr8.25-30.123.1 SUSE-SU-2024:1845-1
SLES for SAP 12 SP5 java-1_8_0-openjdk 1.8.0.412-27.99.1 SUSE-SU-2024:1450-1
SLE HPC 15 SP4 java-11-openjdk 11.0.23.0-150000.3.113.1 SUSE-SU-2024:1498-1
SLE HPC 15 SP4 java-1_8_0-ibm 1.8.0_sr8.25-150000.3.89.1 SUSE-SU-2024:1859-1
SLE HPC 15 SP4 java-1_8_0-openjdk 1.8.0.412-150000.3.91.1 SUSE-SU-2024:1451-1
SLE HPC 15 SP3 java-11-openjdk 11.0.23.0-150000.3.113.1 SUSE-SU-2024:1498-1
SLE HPC 15 SP3 java-1_8_0-ibm 1.8.0_sr8.25-150000.3.89.1 SUSE-SU-2024:1859-1
SLE HPC 15 SP3 java-1_8_0-openjdk 1.8.0.412-150000.3.91.1 SUSE-SU-2024:1451-1
SLE HPC 15 SP2 java-11-openjdk 11.0.23.0-150000.3.113.1 SUSE-SU-2024:1498-1
SUSE Package Hub 15 SP6 java-11-openj9 11.0.26.0-bp156.4.3.1 openSUSE-SU-2025:0066-1
SUSE Manager Server 4.3 java-11-openjdk 11.0.23.0-150000.3.113.1 SUSE-SU-2024:1498-1
SUSE Manager Proxy 4.3 java-11-openjdk 11.0.23.0-150000.3.113.1 SUSE-SU-2024:1498-1
SUSE Enterprise Storage 7.1 java-11-openjdk 11.0.23.0-150000.3.113.1 SUSE-SU-2024:1498-1
SUSE Enterprise Storage 7.1 java-1_8_0-ibm 1.8.0_sr8.25-150000.3.89.1 SUSE-SU-2024:1859-1
SUSE Enterprise Storage 7.1 java-1_8_0-openjdk 1.8.0.412-150000.3.91.1 SUSE-SU-2024:1451-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed java-11-openjdk 11.0.23.0-1.1 openSUSE-SU-2024:13871-1
openSUSE Tumbleweed java-1_8_0-openj9 +1 1.8.0.412-1.1 openSUSE-SU-2024:13997-1, openSUSE-SU-2024:13879-1
openSUSE Leap 15.6 java-11-openj9 11.0.26.0-bp156.4.3.1 openSUSE-SU-2025:0066-1
openSUSE Leap 15.6 java-11-openjdk 11.0.23.0-150000.3.113.1 SUSE-SU-2024:1498-2
openSUSE Leap 15.6 java-1_8_0-ibm 1.8.0_sr8.25-150000.3.89.1 SUSE-SU-2024:1859-1
openSUSE Leap 15.6 java-1_8_0-openj9 1.8.0.412-150200.3.45.2 SUSE-SU-2024:1793-1
openSUSE Leap 15.5 java-11-openjdk 11.0.23.0-150000.3.113.1 SUSE-SU-2024:1498-1
openSUSE Leap 15.5 java-1_8_0-ibm 1.8.0_sr8.25-150000.3.89.1 SUSE-SU-2024:1859-1
openSUSE Leap 15.5 java-1_8_0-openj9 1.8.0.412-150200.3.45.2 SUSE-SU-2024:1793-1
openSUSE Leap 15.5 java-1_8_0-openjdk 1.8.0.412-150000.3.91.1 SUSE-SU-2024:1451-1
ReleasePackageFixed inAdvisory
Alpine v3.24 openjdk11 11.0.23_p9-r0 —
Alpine v3.24 openjdk8 8.422.05-r0 —
Alpine v3.23 openjdk11 11.0.23_p9-r0 —
Alpine v3.23 openjdk8 8.422.05-r0 —
Alpine v3.22 openjdk11 11.0.23_p9-r0 —
Alpine v3.22 openjdk8 8.422.05-r0 —
Alpine v3.21 openjdk11 11.0.23_p9-r0 —
Alpine v3.21 openjdk8 8.422.05-r0 —
Alpine v3.20 openjdk11 11.0.23_p9-r0 —
Alpine v3.20 openjdk8 8.422.05-r0 —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 openjdk11 11.0.23_p9-r0 —
Alpine v3.18 openjdk11 11.0.23_p9-r0 —
Alpine v3.17 openjdk11 11.0.23_p9-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 java-1.8.0-amazon-corretto +1 1:1.8.0_412.b08-1.amzn2023 ALAS2023-2024-602
Amazon Linux 2023 java-11-amazon-corretto +4 1:11.0.23+9-1.amzn2023 ALAS2023-2024-600
Amazon Linux 2 java-1.8.0-openjdk +15 1:1.8.0.412.b08-1.amzn2.0.1 ALAS2-2024-2540
Amazon Linux 2 java-11-amazon-corretto +2 1:11.0.23+9-1.amzn2 ALAS2-2024-2527

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 java-1.8.0-openjdk +16 1:1.8.0.412.b08-2.0.1.el9 ELSA-2024-1818
Oracle Linux 8 java-1.8.0-openjdk-accessibility +2 1:1.8.0.412.b08-2.0.1.el8 ELSA-2024-1818
Oracle Linux 8 java-11-openjdk +22 1:11.0.23.0.9-3.0.1.el9 ELSA-2024-1822
Oracle Linux 7 java-1.8.0-openjdk +7 1:1.8.0.412.b08-1.el7_9 ELSA-2024-1817
Oracle Linux 7 java-11-openjdk +8 1:11.0.23.0.9-2.0.1.el7_9 ELSA-2024-1821

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling openjdk-11 11.0.23-r0 —
Wolfi rolling openjdk-17 17.0.5.8-r4 —
Wolfi rolling openjdk-7 No fix yet —
Wolfi rolling openjdk-8 +5 8.412.08-r0 —
Wolfi rolling openjdk-9 +4 9.0.4-r5 —

Advisories 36

References