Description
Vulnerability in Oracle Java SE (component: Compiler). The supported version that is affected is Oracle Java SE: 26.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Oracle | Oracle Java SE | 26.0.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openjdk-27 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | openjdk-27 | 27.0.1.0.3+1-1~26.10.1 | USN-9005-1 |
| Ubuntu 26.04 LTS | openjdk-26 | No fix yet | — |
Advisories 3
- WID-SEC-2026-4079 Oracle Java SE: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- USN-9005-1 openjdk-27 vulnerabilities Ubuntu Security Notices (USN) · Nov 11, 2026
- NCSC-2026-0449 Meerdere kwetsbaarheden verholpen in Oracle Java NCSC-NL (Netherlands) · Oct 22, 2026
References
- Oracle Advisory vendor-advisory