Skip to content
OpenAdvisories

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

Affected products

VendorProductAffectedFixed
Oracle Oracle Java SE 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26 —
Oracle Oracle GraalVM for JDK 17.0.18, 21.0.10 —
Oracle Oracle GraalVM Enterprise Edition 21.3.17 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 openjdk-21 21.0.11+10-1 —
Debian 14 openjdk-25 25.0.3+9-1 —
Debian 13 openjdk-21 21.0.11+10-1~deb13u2 —
Debian 13 openjdk-25 25.0.3+9-2~deb13u1 —
Debian 12 openjdk-17 17.0.19+10-1~deb12u2 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 openjdk-8 +3 No fix yet —
Ubuntu 26.04 LTS openjdk-17 17.0.19+10-1~26.04.2 —
Ubuntu 26.04 LTS openjdk-17-crac 17.0.19+10-0ubuntu1~26.04.1 —
Ubuntu 26.04 LTS openjdk-21 21.0.11+10-1~26.04.2 —
Ubuntu 26.04 LTS openjdk-21-crac 21.0.11+10-0ubuntu1~26.04.1 —
Ubuntu 26.04 LTS openjdk-25 25.0.3+9-2~26.04.2 —
Ubuntu 26.04 LTS openjdk-25-crac 25.0.3+9-0ubuntu1~26.04.1 —
Ubuntu 26.04 LTS openjdk-26 26.0.1+8-2~26.04.2 —
Ubuntu 26.04 LTS openjdk-8 8u492-ga~us2-0ubuntu1~26.04.1 —
Ubuntu 26.04 LTS openjdk-lts 11.0.31+11-1ubuntu1~26.04.2 —
Ubuntu 25.10 openjdk-17 17.0.19+10-1~25.10.2 —
Ubuntu 25.10 openjdk-17-crac 17.0.19+10-0ubuntu1~25.10.1 —
Ubuntu 25.10 openjdk-21 21.0.11+10-1~25.10.2 —
Ubuntu 25.10 openjdk-21-crac 21.0.11+10-0ubuntu1~25.10.1 —
Ubuntu 25.10 openjdk-25 25.0.3+9-2~25.10.2 —
Ubuntu 25.10 openjdk-25-crac 25.0.3+9-0ubuntu1~25.10.1 —
Ubuntu 25.10 openjdk-26 26.0.1+8-2~25.10.2 —
Ubuntu 25.10 openjdk-8 8u492-ga~us2-0ubuntu1~25.10.1 —
Ubuntu 25.10 openjdk-lts 11.0.31+11-1ubuntu1~25.10.2 —
Ubuntu 24.04 LTS openjdk-17 17.0.19+10-1~24.04.2 —
Ubuntu 24.04 LTS openjdk-21 21.0.11+10-1~24.04.2 —
Ubuntu 24.04 LTS openjdk-25 25.0.3+9-2~24.04.2 —
Ubuntu 24.04 LTS openjdk-8 8u492-ga~us2-0ubuntu1~24.04.1 —
Ubuntu 24.04 LTS openjdk-lts 11.0.31+11-1ubuntu1~24.04.2 —
Ubuntu 22.04 LTS openjdk-17 17.0.19+10-1~22.04.2 —
Ubuntu 22.04 LTS openjdk-18 No fix yet —
Ubuntu 22.04 LTS openjdk-21 21.0.11+10-1~22.04.2 —
Ubuntu 22.04 LTS openjdk-25 25.0.3+9-2~22.04.2 —
Ubuntu 22.04 LTS openjdk-8 8u492-ga~us2-0ubuntu1~22.04.1 —
Ubuntu 22.04 LTS openjdk-lts 11.0.31+11-1ubuntu1~22.04.2 —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS openjdk-13 +1 No fix yet —
Ubuntu 16.04 LTS openjdk-9 No fix yet —
Ubuntu Pro 20.04 LTS openjdk-17 17.0.19+10-1~20.04.2 —
Ubuntu Pro 20.04 LTS openjdk-21 21.0.11+10-1~20.04.2 —
Ubuntu Pro 20.04 LTS openjdk-8 8u492-ga~us2-0ubuntu1~20.04.1 —
Ubuntu Pro 20.04 LTS openjdk-lts 11.0.31+11-1ubuntu1~20.04.2 —
Ubuntu Pro 18.04 LTS openjdk-17 17.0.19+10-1~18.04.2 —
Ubuntu Pro 18.04 LTS openjdk-8 8u492-ga~us2-0ubuntu1~18.04.1 —
Ubuntu Pro 18.04 LTS openjdk-lts 11.0.31+11-1ubuntu1~18.04.2 —
Ubuntu Pro 16.04 LTS openjdk-8 8u492-ga~us2-0ubuntu1~16.04.1 —
ReleasePackageFixed inAdvisory
RHEL 10 java-21-openjdk +22 1:21.0.11.0.10-2.el10_2 RHSA-2026:9689
RHEL 10 java-25-openjdk +25 1:25.0.3.0.9-1.el10_2 RHSA-2026:9693
RHEL 9 java-1.8.0-openjdk +16 1:1.8.0.492.b09-2.el9 RHSA-2026:9683
RHEL 9 java-17-openjdk +22 1:17.0.19.0.10-2.el9 RHSA-2026:9686
RHEL 9 java-21-openjdk +22 1:21.0.11.0.10-2.el9 RHSA-2026:9689
RHEL 9 java-25-openjdk +25 1:25.0.3.0.9-1.el9 RHSA-2026:9693
RHEL 8 java-1.8.0-ibm +7 1:1.8.0.8.65-1.el8_10 RHSA-2026:22139
RHEL 8 java-1.8.0-openjdk +19 1:1.8.0.492.b09-1.el8 RHSA-2026:9683
RHEL 8 java-17-openjdk +22 1:17.0.19.0.10-1.el8 RHSA-2026:9686
RHEL 8 java-21-openjdk +22 1:21.0.11.0.10-1.el8 RHSA-2026:9689
Show 16 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS java-21-openjdk +22 1:21.0.11.0.10-1.el10_2 RHSA-2026:9689
RHEL 9.6 EUS java-1.8.0-openjdk +16 1:1.8.0.492.b09-1.el9 RHSA-2026:9683
RHEL 9.6 EUS java-17-openjdk +22 1:17.0.19.0.10-1.el9 RHSA-2026:9686
RHEL 9.6 EUS java-21-openjdk +22 1:21.0.11.0.10-1.el9 RHSA-2026:9689
RHEL 9.4 EUS java-1.8.0-openjdk +16 1:1.8.0.492.b09-1.el9 RHSA-2026:9683
RHEL 9.4 EUS java-17-openjdk +22 1:17.0.19.0.10-1.el9 RHSA-2026:9686
RHEL 9.4 EUS java-21-openjdk +22 1:21.0.11.0.10-1.el9 RHSA-2026:9689
RHEL 9.2 E4S java-1.8.0-openjdk +6 1:1.8.0.492.b09-1.el9 RHSA-2026:9683
RHEL 9.2 E4S java-17-openjdk +8 1:17.0.19.0.10-1.el9 RHSA-2026:9686
RHEL 9.0 E4S java-1.8.0-openjdk +6 1:1.8.0.492.b09-1.el9 RHSA-2026:9683
RHEL 9.0 E4S java-17-openjdk +8 1:17.0.19.0.10-1.el9 RHSA-2026:9686
RHEL 8.8 TUS java-1.8.0-openjdk +7 1:1.8.0.492.b09-1.el8 RHSA-2026:9683
RHEL 8.8 TUS java-17-openjdk +8 1:17.0.19.0.10-1.el8 RHSA-2026:9686
RHEL 8.8 E4S java-1.8.0-openjdk +7 1:1.8.0.492.b09-1.el8 RHSA-2026:9683
RHEL 8.8 E4S java-17-openjdk +8 1:17.0.19.0.10-1.el8 RHSA-2026:9686
RHEL 8.6 TUS java-1.8.0-openjdk +7 1:1.8.0.492.b09-1.el8 RHSA-2026:9683
RHEL 8.6 TUS java-17-openjdk +8 1:17.0.19.0.10-1.el8 RHSA-2026:9686
RHEL 8.6 E4S java-1.8.0-openjdk +7 1:1.8.0.492.b09-1.el8 RHSA-2026:9683
RHEL 8.6 E4S java-17-openjdk +8 1:17.0.19.0.10-1.el8 RHSA-2026:9686
RHEL 8.6 AUS java-1.8.0-openjdk +7 1:1.8.0.492.b09-1.el8 RHSA-2026:9683
RHEL 8.6 AUS java-17-openjdk +8 1:17.0.19.0.10-1.el8 RHSA-2026:9686
RHEL 8.4 EUS Long Life java-1.8.0-openjdk +7 1:1.8.0.492.b09-1.el8 RHSA-2026:9683
RHEL 8.4 EUS Long Life java-17-openjdk +22 1:17.0.19.0.10-1.el8 RHSA-2026:9686
RHEL 8.4 AUS java-1.8.0-openjdk +7 1:1.8.0.492.b09-1.el8 RHSA-2026:9683
RHEL 8.4 AUS java-17-openjdk +8 1:17.0.19.0.10-1.el8 RHSA-2026:9686
RHEL 8.2 AUS java-1.8.0-openjdk +7 1:1.8.0.492.b09-1.el8 RHSA-2026:9683
RHEL 7 ELS java-1.8.0-openjdk +7 1:1.8.0.492.b09-1.el7_9 RHSA-2026:9682
Red Hat Openjdk Els 11 java-11-openjdk +17 1:11.0.31.0.11-1.el7_9 RHSA-2026:9254
Red Hat Openjdk Els 11 java-11-openjdk-fastdebug +13 1:11.0.31.0.11-1.el8 RHSA-2026:9254
Red Hat Hardened Images 1 java-21-openjdk +22 21.0.11.0.10-1.hum1 RHSA-2026:11655
Red Hat Hardened Images 1 java-21-openjdk-portable +11 21.0.11.0.10-2.hum1 RHSA-2026:11403
Red Hat Hardened Images 1 java-25-openjdk +37 25.0.3.0.9-1.hum1 RHSA-2026:11902, RHSA-2026:11829

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 java-21-openjdk +22 1:21.0.11.0.10-2.el10_2.alma.1 ALSA-2026:9689
AlmaLinux 10 java-25-openjdk +25 1:25.0.3.0.9-1.el10_2 ALSA-2026:9693
AlmaLinux 9 java-1.8.0-openjdk +16 1:1.8.0.492.b09-2.el9.alma.1 ALSA-2026:9683
AlmaLinux 9 java-17-openjdk +22 1:17.0.19.0.10-2.el9.alma.1 ALSA-2026:9686
AlmaLinux 9 java-21-openjdk +22 1:21.0.11.0.10-2.el9.alma.1 ALSA-2026:9689
AlmaLinux 9 java-25-openjdk +25 1:25.0.3.0.9-1.el9.alma.1 ALSA-2026:9693
AlmaLinux 8 java-1.8.0-openjdk +19 1:1.8.0.492.b09-1.el8 ALSA-2026:9683
AlmaLinux 8 java-17-openjdk +22 1:17.0.19.0.10-1.el8 ALSA-2026:9686
AlmaLinux 8 java-21-openjdk +22 1:21.0.11.0.10-1.el8 ALSA-2026:9689

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 java-25-openjdk 1:25.0.3.0.9-1.el10_1 RLSA-2026:9693
Rocky Linux 9 java-21-openjdk 1:21.0.11.0.10-2.el9_7 RLSA-2026:9689
Rocky Linux 8 java-1.8.0-openjdk 1:1.8.0.492.b09-1.el8_10 RLSA-2026:9683
Rocky Linux 8 java-17-openjdk 1:17.0.19.0.10-1.el8_10 RLSA-2026:9686
ReleasePackageFixed inAdvisory
SLES 12 SP5 java-1_8_0-ibm 1.8.0_sr8.65-30.150.1 SUSE-SU-2026:2453-1
SLES 12 SP5 java-1_8_0-openjdk 1.8.0.492-27.128.1 SUSE-SU-2026:2624-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed java-11-openjdk 11.0.31.0-1.1 openSUSE-SU-2026:10636-1
openSUSE Tumbleweed java-17-openjdk 17.0.19.0-1.1 openSUSE-SU-2026:10637-1
openSUSE Tumbleweed java-1_8_0-openjdk 1.8.0.492-1.1 openSUSE-SU-2026:10656-1
openSUSE Tumbleweed java-21-openjdk 21.0.11.0-1.1 openSUSE-SU-2026:10638-1
openSUSE Tumbleweed java-25-openj9 +1 25.0.3.0-1.1 openSUSE-SU-2026:10728-1, openSUSE-SU-2026:10639-1
openSUSE Tumbleweed java-26-openjdk 26.0.1.0-1.1 openSUSE-SU-2026:10893-1
openSUSE Leap 16.0 java-17-openj9 17.0.19.0-bp160.1.1 openSUSE-SU-2026:20943-1
openSUSE Leap 16.0 java-21-openj9 21.0.11.0-bp160.1.1 openSUSE-SU-2026:20947-1
ReleasePackageFixed inAdvisory
Alpine v3.24 openjdk11 11.0.31_p11-r0 —
Alpine v3.24 openjdk17 17.0.19_p10-r0 —
Alpine v3.24 openjdk21 21.0.11_p10-r0 —
Alpine v3.24 openjdk25 25.0.3_p9-r0 —
Alpine v3.24 openjdk8 8.492.09-r0 —
Alpine v3.23 openjdk11 11.0.31_p11-r0 —
Alpine v3.23 openjdk17 17.0.19_p10-r0 —
Alpine v3.23 openjdk21 21.0.11_p10-r0 —
Alpine v3.23 openjdk25 25.0.3_p9-r0 —
Alpine v3.22 openjdk11 11.0.31_p11-r0 —
Alpine v3.22 openjdk17 17.0.19_p10-r0 —
Alpine v3.22 openjdk21 21.0.11_p10-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 java-11-amazon-corretto +5 1:11.0.31+11-1.amzn2023 ALAS2023-2026-1685
Amazon Linux 2023 java-17-amazon-corretto +5 1:17.0.19+10-1.amzn2023.1 ALAS2023-2026-1684
Amazon Linux 2023 java-21-amazon-corretto +5 1:21.0.11+10-1.amzn2023.1 ALAS2023-2026-1683
Amazon Linux 2023 java-25-amazon-corretto +5 1:25.0.3+9-1.amzn2023.1 ALAS2023-2026-1686
Amazon Linux 2023 java-26-amazon-corretto +5 1:26.0.1+8-1.amzn2023.1 ALAS2023-2026-1682
Amazon Linux 2 java-11-amazon-corretto +3 1:11.0.31+11-1.amzn2 ALAS2-2026-3300
Amazon Linux 2 java-17-amazon-corretto +5 1:17.0.19+10-1.amzn2.1 ALAS2-2026-3299

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 java-25-openjdk +25 1:25.0.3.0.9-1.0.1.el10_2 ELSA-2026-9693
Oracle Linux 8 java-1.8.0-openjdk +16 1:1.8.0.492.b09-2.0.1.el9 ELSA-2026-9683
Oracle Linux 8 java-1.8.0-openjdk-accessibility +2 1:1.8.0.492.b09-1.0.1.el8 ELSA-2026-9683
Oracle Linux 8 java-17-openjdk +22 1:17.0.19.0.10-2.0.1.el9 ELSA-2026-9686
Oracle Linux 8 java-21-openjdk +22 1:21.0.11.0.10-2.0.1.el10_1 ELSA-2026-9689
Oracle Linux 7 java-1.8.0-openjdk +7 1:1.8.0.492.b09-1.0.1.el7_9 ELSA-2026-9682

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling openjdk-21 21.0.11-r0 —
Wolfi rolling openjdk-24 +4 No fix yet —
Wolfi rolling openjdk-26 26.0.1-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 48

References