Description

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-18T21:17:48.513Z",
  "pubdate": "2026-08-18T21:17:48.513Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. This vulnerability allows an unauthenticated remote attacker with network access via the TLS protocol to compromise the affected products. The primary impact of a successful attack is the unauthorized capability to cause a partial denial of service (partial DoS) of the targeted application or service. The flaw can be exploited remotely over the network without requiring any user interaction or prior authentication privileges. Exploitation requires supplying specific data directly to APIs within the vulnerable component, such as through a web service, bypassing the need for untrusted Java Web Start applications or untrusted Java applets. The associated CVSS 3.1 Base Score is 5.3, with impacts exclusively restricted to service availability (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Organizations utilizing the affected software versions face operational risks associated with service degradation or intermittent outages if exposed services handle untrusted or maliciously crafted TLS traffic without proper input validation and resource management controls.",
  "technicalDetails": "The vulnerability resides in the Java Secure Socket Extension (JSSE) component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Specifically, affected versions include Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; and Oracle GraalVM Enterprise Edition: 21.3.19. The root cause involves improper handling of TLS network traffic or data structures processed by the JSSE APIs, leading to excessive resource consumption or exception handling failures that manifest as a partial denial of service. The attack vector is strictly network-based (AV:N), leveraging the TLS protocol to interact with exposed endpoints. Attack complexity is low (AC:L), requiring minimal preparatory effort by the threat actor to craft the attack payload. The vulnerability does not require authentication privileges (PR:N) nor user interaction (UI:N), allowing any unauthenticated network entity to initiate the attack sequence. The scope is unmodified (S:U), meaning the impact remains restricted to the vulnerable component and does not propagate to underlying host resources beyond the application boundary. Exploitation occurs step-by-step as the attacker establishes a TLS connection or transmits specifically crafted TLS handshake or record layer data to an application utilizing the vulnerable JSSE APIs, such as a custom web service or network daemon. Upon ingestion of the malicious input, the JSSE component encounters parsing errors, state machine anomalies, or algorithmic inefficiencies during cryptographic or protocol negotiation phases. This forces the allocation of disproportionate CPU cycles, memory resources, or thread exhaustion, resulting in degraded performance, unresponsiveness, or partial service outages for legitimate clients. Post-exploitation impact is limited to availability disruption (A:L), as confidentiality and integrity vectors are unaffected (C:N, I:N). Because the vulnerability can be triggered via standard API calls processing network data without relying on client-side vectors like Java Web Start or applets, any server-side application directly exposing vulnerable JSSE endpoints to untrusted networks is at risk."
}