Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-70907 EUVD-2026-61856GHSA-x2cm-pmmm-v6xc

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).…

Published Aug 18, 2026 · Updated Aug 19, 2026 · Assigned by oracle

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Affected products

VendorProductAffectedFixed
Oracle Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition Oracle Java SE:8u501, Oracle Java SE:11.0.32, Oracle Java SE:17.0.20, Oracle Java SE:21.0.12, Oracle Java SE:25.0.4, Oracle Java SE:26.0.2, Oracle GraalVM for JDK:17.0.20, Oracle GraalVM for JDK:21.0.12, Oracle GraalVM Enterprise Edition:21.3.19 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 openjdk-21 21.0.12.1+1-1 —
Debian 14 openjdk-25 25.0.4.1+1-1 —
Debian 13 openjdk-21 21.0.12.1+1-1~deb13u1 —
Debian 13 openjdk-25 25.0.4.1+1-1~deb13u1 —
Debian 12 openjdk-17 17.0.20.1+1-1~deb12u1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 openjdk-17 +3 No fix yet —
Ubuntu 26.04 LTS openjdk-17 17.0.20.1+1-1~26.04 USN-8795-1
Ubuntu 26.04 LTS openjdk-17-crac +1 No fix yet —
Ubuntu 26.04 LTS openjdk-21 21.0.12.1+1-1~26.04.4 USN-8796-1
Ubuntu 26.04 LTS openjdk-25 25.0.4.1+1-1~26.04.4 USN-8783-1
Ubuntu 26.04 LTS openjdk-8 8u504-ga-1ubuntu1~26.04.3 USN-8784-1
Ubuntu 26.04 LTS openjdk-lts 11.0.32.1+1-1ubuntu1~26.04 USN-8785-1
Ubuntu 24.04 LTS openjdk-17 17.0.20.1+1-1~24.04 USN-8795-1
Ubuntu 24.04 LTS openjdk-21 21.0.12.1+1-1~24.04.4 USN-8796-1
Ubuntu 24.04 LTS openjdk-25 25.0.4.1+1-1~24.04.4 USN-8783-1
Ubuntu 24.04 LTS openjdk-8 8u504-ga-1ubuntu1~24.04.3 USN-8784-1
Ubuntu 24.04 LTS openjdk-lts 11.0.32.1+1-1ubuntu1~24.04 USN-8785-1
Ubuntu 22.04 LTS openjdk-17 17.0.20.1+1-1~22.04 USN-8795-1
Ubuntu 22.04 LTS openjdk-18 No fix yet —
Ubuntu 22.04 LTS openjdk-21 21.0.12.1+1-1~22.04.4 USN-8796-1
Ubuntu 22.04 LTS openjdk-25 25.0.4.1+1-1~22.04.4 USN-8783-1
Ubuntu 22.04 LTS openjdk-8 8u504-ga-1ubuntu1~22.04.3 USN-8784-1
Ubuntu 22.04 LTS openjdk-lts 11.0.32.1+1-1ubuntu1~22.04 USN-8785-1
Ubuntu 20.04 LTS openjdk-13 +1 No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS openjdk-9 No fix yet —
Ubuntu Pro 20.04 LTS openjdk-17 17.0.20.1+1-1~20.04 USN-8795-1
Ubuntu Pro 20.04 LTS openjdk-21 21.0.12.1+1-1~20.04.4 USN-8796-1
Ubuntu Pro 20.04 LTS openjdk-8 8u504-ga-1ubuntu1~20.04.3 USN-8784-1
Ubuntu Pro 20.04 LTS openjdk-lts 11.0.32.1+1-1ubuntu1~20.04 USN-8785-1
Ubuntu Pro 18.04 LTS openjdk-17 17.0.20.1+1-1~18.04 USN-8795-1
Ubuntu Pro 18.04 LTS openjdk-8 8u504-ga-1ubuntu1~18.04.3 USN-8784-1
Ubuntu Pro 18.04 LTS openjdk-lts 11.0.32.1+1-1ubuntu1~18.04 USN-8785-1
Ubuntu Pro 16.04 LTS openjdk-8 8u504-ga-1ubuntu1~16.04.3 USN-8784-1
ReleasePackageFixed inAdvisory
RHEL 10 java-21-ibm-semeru-certified-jdk +4 1:21.0.12.1.1-2.el10_2 RHSA-2026:72888
RHEL 10 java-21-openjdk +22 1:21.0.12.1.1-1.2.el10 RHSA-2026:55787
RHEL 10 java-25-openjdk +25 1:25.0.4.1.1-1.1.el10 RHSA-2026:55798
RHEL 9 java-1.8.0-openjdk +16 1:1.8.0.504.b01-1.2.el9 RHSA-2026:55775
RHEL 9 java-17-openjdk +22 1:17.0.20.1.1-1.2.el9 RHSA-2026:55781
RHEL 9 java-21-openjdk +22 1:21.0.12.1.1-1.2.el9 RHSA-2026:55787
RHEL 9 java-25-openjdk +25 1:25.0.4.1.1-1.1.el9 RHSA-2026:55798
RHEL 8 java-1.8.0-ibm +7 1:1.8.0.8.71-1.el8_10 RHSA-2026:70630
RHEL 8 java-1.8.0-openjdk +19 1:1.8.0.504.b01-1.1.el8 RHSA-2026:55775
RHEL 8 java-17-openjdk +22 1:17.0.20.1.1-1.1.el8 RHSA-2026:55781
RHEL 8 java-21-openjdk +22 1:21.0.12.1.1-1.1.el8 RHSA-2026:55787
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS java-21-ibm-semeru-certified-jdk +1 1:21.0.12.1.1-1.el10_0 RHSA-2026:72888
RHEL 10.0 EUS java-21-openjdk +22 1:21.0.12.1.1-1.1.el10 RHSA-2026:55787
RHEL 9.6 EUS java-1.8.0-openjdk +16 1:1.8.0.504.b01-1.1.el9 RHSA-2026:55775
RHEL 9.6 EUS java-17-openjdk +22 1:17.0.20.1.1-1.1.el9 RHSA-2026:55781
RHEL 9.6 EUS java-21-openjdk +22 1:21.0.12.1.1-1.1.el9 RHSA-2026:55787
RHEL 9.4 E4S java-1.8.0-openjdk +6 1:1.8.0.504.b01-1.1.el9 RHSA-2026:55775
RHEL 9.4 E4S java-17-openjdk +8 1:17.0.20.1.1-1.1.el9 RHSA-2026:55781
RHEL 9.4 E4S java-21-openjdk +8 1:21.0.12.1.1-1.1.el9 RHSA-2026:55787
RHEL 9.2 E4S java-1.8.0-openjdk +6 1:1.8.0.504.b01-1.1.el9 RHSA-2026:55775
RHEL 9.2 E4S java-17-openjdk +8 1:17.0.20.1.1-1.1.el9 RHSA-2026:55781
RHEL 8.8 TUS java-1.8.0-openjdk +7 1:1.8.0.504.b01-1.1.el8 RHSA-2026:55775
RHEL 8.8 TUS java-17-openjdk +8 1:17.0.20.1.1-1.1.el8 RHSA-2026:55781
RHEL 8.8 E4S java-1.8.0-openjdk +7 1:1.8.0.504.b01-1.1.el8 RHSA-2026:55775
RHEL 8.8 E4S java-17-openjdk +8 1:17.0.20.1.1-1.1.el8 RHSA-2026:55781
RHEL 8.6 EUS Long Life java-1.8.0-openjdk +7 1:1.8.0.504.b01-1.1.el8 RHSA-2026:55775
RHEL 8.6 EUS Long Life java-17-openjdk +8 1:17.0.20.1.1-1.1.el8 RHSA-2026:55781
RHEL 8.6 AUS java-1.8.0-openjdk +7 1:1.8.0.504.b01-1.1.el8 RHSA-2026:55775
RHEL 8.6 AUS java-17-openjdk +8 1:17.0.20.1.1-1.1.el8 RHSA-2026:55781
RHEL 8.4 EUS Long Life java-1.8.0-openjdk +7 1:1.8.0.504.b01-1.1.el8 RHSA-2026:55775
RHEL 8.4 EUS Long Life java-17-openjdk +22 1:17.0.20.1.1-1.1.el8 RHSA-2026:55781
RHEL 8.4 AUS java-1.8.0-openjdk +7 1:1.8.0.504.b01-1.1.el8 RHSA-2026:55775
RHEL 8.4 AUS java-17-openjdk +8 1:17.0.20.1.1-1.1.el8 RHSA-2026:55781
RHEL 7 ELS java-1.8.0-openjdk +7 1:1.8.0.504.b01-1.1.el7_9 RHSA-2026:55774
Red Hat Openjdk Els 11 java-11-openjdk +17 1:11.0.32.1.1-1.el7_9 RHSA-2026:55778
Red Hat Openjdk Els 11 java-11-openjdk-fastdebug +13 1:11.0.32.1.1-1.el8 RHSA-2026:55778
Red Hat Hardened Images 1 java-21-openjdk +22 21.0.12.1.1-1.0.hum1 RHSA-2026:58266
Red Hat Hardened Images 1 java-21-openjdk-portable +11 21.0.12.1.1-0.1.hum1 RHSA-2026:57175
Red Hat Hardened Images 1 java-25-openjdk +25 25.0.4.1.1-1.1.hum1 RHSA-2026:57765
Red Hat Hardened Images 1 java-25-openjdk-portable +11 25.0.4.1.1-0.1.hum1 RHSA-2026:57177

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 java-21-openjdk +22 1:21.0.12.1.1-1.2.el10.alma.1 ALSA-2026:55787
AlmaLinux 10 java-25-openjdk +25 1:25.0.4.1.1-1.1.el10.alma.1 ALSA-2026:55798
AlmaLinux 9 java-1.8.0-openjdk +16 1:1.8.0.504.b01-1.2.el9.alma.1 ALSA-2026:55775
AlmaLinux 9 java-17-openjdk +22 1:17.0.20.1.1-1.2.el9.alma.1 ALSA-2026:55781
AlmaLinux 9 java-21-openjdk +22 1:21.0.12.1.1-1.2.el9.alma.1 ALSA-2026:55787
AlmaLinux 9 java-25-openjdk +25 1:25.0.4.1.1-1.1.el9.alma.1 ALSA-2026:55798
AlmaLinux 8 java-1.8.0-openjdk +19 1:1.8.0.504.b01-1.1.el8 ALSA-2026:55775
AlmaLinux 8 java-17-openjdk +22 1:17.0.20.1.1-1.1.el8 ALSA-2026:55781
AlmaLinux 8 java-21-openjdk +22 1:21.0.12.1.1-1.1.el8 ALSA-2026:55787

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 java-25-openjdk 1:25.0.4.1.1-1.1.el10_2 RLSA-2026:55798
Rocky Linux 8 java-1.8.0-openjdk 1:1.8.0.504.b01-1.1.el8_10 RLSA-2026:55775
Rocky Linux 8 java-17-openjdk 1:17.0.20.1.1-1.1.el8_10 RLSA-2026:55781
Rocky Linux 8 java-21-openjdk 1:21.0.12.1.1-1.1.el8_10 RLSA-2026:55787
ReleasePackageFixed inAdvisory
SLES 15 SP7 java-11-openjdk 11.0.32.1-150000.3.144.1 SUSE-SU-2026:4339-1
SLES 15 SP7 java-17-openjdk 17.0.20.1-150400.3.72.1 SUSE-SU-2026:4002-1
SLES 15 SP7 java-1_8_0-ibm 1.8.0_sr8.71-150000.3.125.1 SUSE-SU-2026:4153-1
SLES 15 SP7 java-1_8_0-openjdk 1.8.0.504-150000.3.126.1 SUSE-SU-2026:3998-1
SLES 15 SP7 java-21-openjdk 21.0.12.1-150600.3.32.1 SUSE-SU-2026:4006-1
SLES 15 SP7 java-25-openjdk 25.0.4.1-150700.15.16.1 SUSE-SU-2026:3999-1
SLES 15 SP6 java-11-openjdk 11.0.32.1-150000.3.144.1 SUSE-SU-2026:4339-1
SLES 15 SP6 java-17-openjdk 17.0.20.1-150400.3.72.1 SUSE-SU-2026:4002-1
SLES 15 SP6 java-1_8_0-ibm 1.8.0_sr8.71-150000.3.125.1 SUSE-SU-2026:4153-1
SLES 15 SP6 java-1_8_0-openjdk 1.8.0.504-150000.3.126.1 SUSE-SU-2026:3998-1
SLES 15 SP6 java-21-openjdk 21.0.12.1-150600.3.32.1 SUSE-SU-2026:4006-1
SLES 15 SP5 java-11-openjdk 11.0.32.1-150000.3.144.1 SUSE-SU-2026:4339-1
SLES 15 SP5 java-17-openjdk 17.0.20.1-150400.3.72.1 SUSE-SU-2026:4002-1
SLES 15 SP5 java-1_8_0-ibm 1.8.0_sr8.71-150000.3.125.1 SUSE-SU-2026:4153-1
SLES 15 SP5 java-1_8_0-openjdk 1.8.0.504-150000.3.126.1 SUSE-SU-2026:3998-1
SLES 15 SP4 java-11-openjdk 11.0.32.1-150000.3.144.1 SUSE-SU-2026:4339-1
SLES 15 SP4 java-17-openjdk 17.0.20.1-150400.3.72.1 SUSE-SU-2026:4002-1
SLES 15 SP4 java-1_8_0-ibm 1.8.0_sr8.71-150000.3.125.1 SUSE-SU-2026:4153-1
SLES 15 SP4 java-1_8_0-openjdk 1.8.0.504-150000.3.126.1 SUSE-SU-2026:3998-1
SLES 12 SP5 java-11-openjdk 11.0.32.1-3.105.1 SUSE-SU-2026:4515-1
SLES 12 SP5 java-1_8_0-ibm 1.8.0_sr8.71-30.156.1 SUSE-SU-2026:4107-1
SLES 12 SP5 java-1_8_0-openjdk 1.8.0.504-27.134.1 SUSE-SU-2026:4054-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 java-17-openjdk 17.0.20.1-160000.1.1 SUSE-SU-2026:23610-1
SLES for SAP 16.0 java-21-openjdk 21.0.12.1-160000.1.1 SUSE-SU-2026:23624-1
SLES for SAP 16.0 java-25-openjdk 25.0.4.1-160000.1.1 SUSE-SU-2026:23591-1
SLES for SAP 15 SP6 java-11-openjdk 11.0.32.1-150000.3.144.1 SUSE-SU-2026:4339-1
SLES for SAP 15 SP6 java-17-openjdk 17.0.20.1-150400.3.72.1 SUSE-SU-2026:4002-1
SLES for SAP 15 SP6 java-1_8_0-ibm 1.8.0_sr8.71-150000.3.125.1 SUSE-SU-2026:4153-1
SLES for SAP 15 SP6 java-1_8_0-openjdk 1.8.0.504-150000.3.126.1 SUSE-SU-2026:3998-1
SLES for SAP 15 SP6 java-21-openjdk 21.0.12.1-150600.3.32.1 SUSE-SU-2026:4006-1
SLES for SAP 15 SP5 java-11-openjdk 11.0.32.1-150000.3.144.1 SUSE-SU-2026:4339-1
SLES for SAP 15 SP5 java-17-openjdk 17.0.20.1-150400.3.72.1 SUSE-SU-2026:4002-1
SLES for SAP 15 SP5 java-1_8_0-ibm 1.8.0_sr8.71-150000.3.125.1 SUSE-SU-2026:4153-1
SLES for SAP 15 SP5 java-1_8_0-openjdk 1.8.0.504-150000.3.126.1 SUSE-SU-2026:3998-1
SLES for SAP 15 SP4 java-11-openjdk 11.0.32.1-150000.3.144.1 SUSE-SU-2026:4339-1
SLES for SAP 15 SP4 java-17-openjdk 17.0.20.1-150400.3.72.1 SUSE-SU-2026:4002-1
SLES for SAP 15 SP4 java-1_8_0-ibm 1.8.0_sr8.71-150000.3.125.1 SUSE-SU-2026:4153-1
SLES for SAP 15 SP4 java-1_8_0-openjdk 1.8.0.504-150000.3.126.1 SUSE-SU-2026:3998-1
SLES 16.0 java-17-openjdk 17.0.20.1-160000.1.1 SUSE-SU-2026:23610-1
SLES 16.0 java-21-openjdk 21.0.12.1-160000.1.1 SUSE-SU-2026:23624-1
SLES 16.0 java-25-openjdk 25.0.4.1-160000.1.1 SUSE-SU-2026:23591-1
SLE HPC 15 SP5 java-11-openjdk 11.0.32.1-150000.3.144.1 SUSE-SU-2026:4339-1
SLE HPC 15 SP5 java-17-openjdk 17.0.20.1-150400.3.72.1 SUSE-SU-2026:4002-1
SLE HPC 15 SP4 java-11-openjdk 11.0.32.1-150000.3.144.1 SUSE-SU-2026:4339-1
SLE HPC 15 SP4 java-17-openjdk 17.0.20.1-150400.3.72.1 SUSE-SU-2026:4002-1
SLE HPC 15 SP4 java-1_8_0-ibm 1.8.0_sr8.71-150000.3.125.1 SUSE-SU-2026:4153-1
SLE HPC 15 SP4 java-1_8_0-openjdk 1.8.0.504-150000.3.126.1 SUSE-SU-2026:3998-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed java-11-openj9 +1 11.0.32.1-1.1 openSUSE-SU-2026:11639-1, openSUSE-SU-2026:11594-1
openSUSE Tumbleweed java-17-openj9 +1 17.0.20.1-1.1 openSUSE-SU-2026:11640-1, openSUSE-SU-2026:11595-1
openSUSE Tumbleweed java-1_8_0-openj9 +1 1.8.0.504-1.1 openSUSE-SU-2026:11652-1, openSUSE-SU-2026:11641-1
openSUSE Tumbleweed java-21-openj9 +1 21.0.12.1-1.1 openSUSE-SU-2026:11642-1, openSUSE-SU-2026:11620-1
openSUSE Tumbleweed java-25-openj9 +1 25.0.4.1-1.1 openSUSE-SU-2026:11643-1, openSUSE-SU-2026:11621-1
openSUSE Leap 16.0 java-17-openjdk 17.0.20.1-160000.1.1 openSUSE-SU-2026:21745-1
openSUSE Leap 16.0 java-21-openjdk 21.0.12.1-160000.1.1 openSUSE-SU-2026:21759-1
openSUSE Leap 16.0 java-25-openjdk 25.0.4.1-160000.1.1 openSUSE-SU-2026:21714-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 java-1.8.0-amazon-corretto +2 1:1.8.0_504.b01-1.amzn2023 ALAS2023-2026-2100
Amazon Linux 2023 java-11-amazon-corretto +5 1:11.0.32+10-1.amzn2023 ALAS2023-2026-2099
Amazon Linux 2023 java-17-amazon-corretto +5 1:17.0.20+10-1.amzn2023.1 ALAS2023-2026-2098
Amazon Linux 2023 java-21-amazon-corretto +5 1:21.0.12+9-1.amzn2023.1 ALAS2023-2026-2097
Amazon Linux 2023 java-25-amazon-corretto +5 1:25.0.4+8-1.amzn2023.1 ALAS2023-2026-2102
Amazon Linux 2023 java-26-amazon-corretto +5 1:26.0.2+11-1.amzn2023.1 ALAS2023-2026-2101
Amazon Linux 2 java-1.8.0-openjdk +15 1:1.8.0.504.b01-1.amzn2.0.1 ALAS2-2026-3888
Amazon Linux 2 java-11-amazon-corretto +3 1:11.0.32+10-1.amzn2 ALAS2-2026-3879
Amazon Linux 2 java-17-amazon-corretto +5 1:17.0.20+10-1.amzn2.1 ALAS2-2026-3878

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 java-25-openjdk +25 1:25.0.4.1.1-1.1.0.1.el10 ELSA-2026-55798
Oracle Linux 8 java-1.8.0-openjdk +16 1:1.8.0.504.b01-1.2.0.1.el9 ELSA-2026-55775
Oracle Linux 8 java-1.8.0-openjdk-accessibility +2 1:1.8.0.504.b01-1.1.0.1.el8 ELSA-2026-55775
Oracle Linux 8 java-17-openjdk +22 1:17.0.20.1.1-1.2.0.1.el9 ELSA-2026-55781
Oracle Linux 8 java-21-openjdk +22 1:21.0.12.1.1-1.2.0.1.el10 ELSA-2026-55787
Oracle Linux 7 java-1.8.0-openjdk +7 1:1.8.0.504.b01-1.0.1.el7_9 ELSA-2026-55774

Advisories 50

References