Source: opendjk-8 X-Debbugs-CC: [email protected] Severity: grave Tags: security
Hi, The following vulnerabilities were published for opendjk-8. CVE-2026-91395[0]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | Utility). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1; Oracle GraalVM for JDK: 17.0.20.1 | and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. | Easily exploitable vulnerability allows unauthenticated attacker | with network access via multiple protocols to compromise Oracle Java | SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. | Successful attacks of this vulnerability can result in unauthorized | update, insert or delete access to some of Oracle Java SE, Oracle | GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data | and unauthorized ability to cause a partial denial of service | (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition. Note: This vulnerability can be | exploited by using APIs in the specified Component, e.g., through a | web service which supplies data to the APIs. This vulnerability also | applies to Java deployments, typically in clients running sandboxed | Java Web Start applications or sandboxed Java applets, that load and | run untrusted code (e.g., code that comes from the internet) and | rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 | (Integrity and Availability impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). CVE-2026-91396[1]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | Utility). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1; Oracle GraalVM for JDK: 17.0.20.1 | and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. | Easily exploitable vulnerability allows unauthenticated attacker | with network access via multiple protocols to compromise Oracle Java | SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. | Successful attacks of this vulnerability can result in unauthorized | update, insert or delete access to some of Oracle Java SE, Oracle | GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data | and unauthorized ability to cause a partial denial of service | (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition. Note: This vulnerability can be | exploited by using APIs in the specified Component, e.g., through a | web service which supplies data to the APIs. This vulnerability also | applies to Java deployments, typically in clients running sandboxed | Java Web Start applications or sandboxed Java applets, that load and | run untrusted code (e.g., code that comes from the internet) and | rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 | (Integrity and Availability impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). CVE-2026-91397[2]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | Serviceability). Supported versions that are affected are Oracle | Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, | 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; | Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit | vulnerability allows unauthenticated attacker with logon to the | infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition executes to compromise Oracle Java SE, | Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. | Successful attacks require human interaction from a person other | than the attacker. Successful attacks of this vulnerability can | result in unauthorized update, insert or delete access to some of | Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise | Edition accessible data and unauthorized ability to cause a partial | denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM | for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability | can be exploited by using APIs in the specified Component, e.g., | through a web service which supplies data to the APIs. This | vulnerability also applies to Java deployments, typically in clients | running sandboxed Java Web Start applications or sandboxed Java | applets, that load and run untrusted code (e.g., code that comes | from the internet) and rely on the Java sandbox for security. CVSS | 3.1 Base Score 3.6 (Integrity and Availability impacts). CVSS | Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L). CVE-2026-91398[3]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | Networking). Supported versions that are affected are Oracle Java | SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, | 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle | GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit | vulnerability allows unauthenticated attacker with network access | via SOCKS5 to compromise Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition. While the vulnerability is in | Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise | Edition, attacks may significantly impact additional products (scope | change). Successful attacks of this vulnerability can result in | unauthorized creation, deletion or modification access to critical | data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM | Enterprise Edition accessible data. Note: This vulnerability can be | exploited by using APIs in the specified Component, e.g., through a | web service which supplies data to the APIs. This vulnerability also | applies to Java deployments, typically in clients running sandboxed | Java Web Start applications or sandboxed Java applets, that load and | run untrusted code (e.g., code that comes from the internet) and | rely on the Java sandbox for security. CVSS 3.1 Base Score 6.8 | (Integrity impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N). CVE-2026-91400[4]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | Sound). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; | Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM | Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability | allows unauthenticated attacker with network access via multiple | protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition. Successful attacks require human | interaction from a person other than the attacker. Successful | attacks of this vulnerability can result in unauthorized ability to | cause a partial denial of service (partial DOS) of Oracle Java SE, | Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: | This vulnerability applies to Java deployments, typically in clients | running sandboxed Java Web Start applications or sandboxed Java | applets, that load and run untrusted code (e.g., code that comes | from the internet) and rely on the Java sandbox for security. This | vulnerability does not apply to Java deployments, typically in | servers, that load and run only trusted code (e.g., code installed | by an administrator). CVSS 3.1 Base Score 3.1 (Availability | impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L). CVE-2026-83374[5]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | Security). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; | Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM | Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability | allows unauthenticated attacker with network access via multiple | protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition. Successful attacks of this | vulnerability can result in unauthorized creation, deletion or | modification access to critical data or all Oracle Java SE, Oracle | GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. | Note: This vulnerability can be exploited by using APIs in the | specified Component, e.g., through a web service which supplies data | to the APIs. This vulnerability also applies to Java deployments, | typically in clients running sandboxed Java Web Start applications | or sandboxed Java applets, that load and run untrusted code (e.g., | code that comes from the internet) and rely on the Java sandbox for | security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). CVE-2026-91487[6]: | Vulnerability in Oracle Java SE (component: Compiler). Supported | versions that are affected are Oracle Java SE: 8u503-perf, | 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for | JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: | 21.3.19.1.1. Difficult to exploit vulnerability allows | unauthenticated attacker with network access via multiple protocols | to compromise Oracle Java SE. Successful attacks of this | vulnerability can result in unauthorized update, insert or delete | access to some of Oracle Java SE accessible data as well as | unauthorized read access to a subset of Oracle Java SE accessible | data. Note: This vulnerability can only be exploited by supplying | data to APIs in the specified Component without using Untrusted Java | Web Start applications or Untrusted Java applets, such as through a | web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity | impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). CVE-2026-83376[7]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | JSSE). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; | Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM | Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability | allows unauthenticated attacker with network access via TLS to | compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM | Enterprise Edition. Successful attacks of this vulnerability can | result in unauthorized update, insert or delete access to some of | Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise | Edition accessible data. Note: This vulnerability can be exploited | by using APIs in the specified Component, e.g., through a web | service which supplies data to the APIs. This vulnerability also | applies to Java deployments, typically in clients running sandboxed | Java Web Start applications or sandboxed Java applets, that load and | run untrusted code (e.g., code that comes from the internet) and | rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 | (Integrity impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2026-83380[8]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | JAAS). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; | Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM | Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability | allows unauthenticated attacker with network access via multiple | protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition. Successful attacks of this | vulnerability can result in unauthorized read access to a subset of | Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise | Edition accessible data. Note: This vulnerability can be exploited | by using APIs in the specified Component, e.g., through a web | service which supplies data to the APIs. This vulnerability also | applies to Java deployments, typically in clients running sandboxed | Java Web Start applications or sandboxed Java applets, that load and | run untrusted code (e.g., code that comes from the internet) and | rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 | (Confidentiality impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). CVE-2026-91403[9]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | JSSE). Supported versions that are affected are Oracle Java SE: | 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle | GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise | Edition: 21.3.20. Easily exploitable vulnerability allows | unauthenticated attacker with network access via multiple protocols | to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM | Enterprise Edition. Successful attacks of this vulnerability can | result in unauthorized creation, deletion or modification access to | critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition accessible data as well as unauthorized | access to critical data or complete access to all Oracle Java SE, | Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible | data. Note: This vulnerability can be exploited by using APIs in the | specified Component, e.g., through a web service which supplies data | to the APIs. This vulnerability also applies to Java deployments, | typically in clients running sandboxed Java Web Start applications | or sandboxed Java applets, that load and run untrusted code (e.g., | code that comes from the internet) and rely on the Java sandbox for | security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity | impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). CVE-2026-91410[10]: | Vulnerability in Oracle Java SE (component: Libraries). Supported | versions that are affected are Oracle Java SE: 8u503, 8u503-perf, | 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: | 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: | 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated | attacker with network access via multiple protocols to compromise | Oracle Java SE. Successful attacks of this vulnerability can result | in unauthorized ability to cause a partial denial of service | (partial DOS) of Oracle Java SE. Note: This vulnerability can be | exploited by using APIs in the specified Component, e.g., through a | web service which supplies data to the APIs. This vulnerability also | applies to Java deployments, typically in clients running sandboxed | Java Web Start applications or sandboxed Java applets, that load and | run untrusted code (e.g., code that comes from the internet) and | rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 | (Availability impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). CVE-2026-91411[11]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | JGSS). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1; Oracle GraalVM for JDK: 17.0.20.1 | and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. | Difficult to exploit vulnerability allows unauthenticated attacker | with network access via multiple protocols to compromise Oracle Java | SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. | Successful attacks of this vulnerability can result in unauthorized | ability to cause a hang or frequently repeatable crash (complete | DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM | Enterprise Edition as well as unauthorized update, insert or delete | access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition accessible data. Note: This vulnerability | can be exploited by using APIs in the specified Component, e.g., | through a web service which supplies data to the APIs. This | vulnerability also applies to Java deployments, typically in clients | running sandboxed Java Web Start applications or sandboxed Java | applets, that load and run untrusted code (e.g., code that comes | from the internet) and rely on the Java sandbox for security. CVSS | 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS | Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H). CVE-2026-91415[12]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | 2D). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; | Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM | Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability | allows unauthenticated attacker with network access via multiple | protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition. Successful attacks of this | vulnerability can result in unauthorized ability to cause a hang or | frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle | GraalVM for JDK, Oracle GraalVM Enterprise Edition as well as | unauthorized update, insert or delete access to some of Oracle Java | SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition | accessible data and unauthorized read access to a subset of Oracle | Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition | accessible data. Note: This vulnerability can be exploited by using | APIs in the specified Component, e.g., through a web service which | supplies data to the APIs. This vulnerability also applies to Java | deployments, typically in clients running sandboxed Java Web Start | applications or sandboxed Java applets, that load and run untrusted | code (e.g., code that comes from the internet) and rely on the Java | sandbox for security. CVSS 3.1 Base Score 7.0 (Confidentiality, | Integrity and Availability impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H). CVE-2026-91417[13]: | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise | Edition product of Oracle Java SE (component: CORBA). Supported | versions that are affected are Oracle Java SE: 8u503 and | 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily | exploitable vulnerability allows unauthenticated attacker with | network access via multiple protocols to compromise Oracle Java SE, | Oracle GraalVM Enterprise Edition. Successful attacks of this | vulnerability can result in unauthorized ability to cause a partial | denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM | Enterprise Edition. Note: This vulnerability can only be exploited | by supplying data to APIs in the specified Component without using | Untrusted Java Web Start applications or Untrusted Java applets, | such as through a web service. CVSS 3.1 Base Score 5.3 (Availability | impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). CVE-2026-91418[14]: | Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM | for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE | (component: ImageIO). Supported versions that are affected are | Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, | 25.0.4.1, 27; Oracle JavaFX: 21.0.12, 25.0.4, 27; Oracle GraalVM for | JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: | 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated | attacker with network access via multiple protocols to compromise | Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition. Successful attacks of this | vulnerability can result in unauthorized ability to cause a partial | denial of service (partial DOS) of Oracle Java SE, Oracle JavaFX, | Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: | This vulnerability can be exploited by using APIs in the specified | Component, e.g., through a web service which supplies data to the | APIs. This vulnerability also applies to Java deployments, typically | in clients running sandboxed Java Web Start applications or | sandboxed Java applets, that load and run untrusted code (e.g., code | that comes from the internet) and rely on the Java sandbox for | security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS | Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). CVE-2026-91451[15]: | Vulnerability in Oracle Java SE (component: Networking). Supported | versions that are affected are Oracle Java SE: 8u503, 8u503-perf, | 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: | 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: | 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated | attacker with network access via multiple protocols to compromise | Oracle Java SE. Successful attacks of this vulnerability can result | in unauthorized update, insert or delete access to some of Oracle | Java SE accessible data. Note: This vulnerability can only be | exploited by supplying data to APIs in the specified Component | without using Untrusted Java Web Start applications or Untrusted | Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 | (Integrity impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2026-91452[16]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | Networking). Supported versions that are affected are Oracle Java | SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, | 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM | Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability | allows unauthenticated attacker with network access via multiple | protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition. Successful attacks of this | vulnerability can result in unauthorized update, insert or delete | access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition accessible data. Note: This vulnerability | can only be exploited by supplying data to APIs in the specified | Component without using Untrusted Java Web Start applications or | Untrusted Java applets, such as through a web service. CVSS 3.1 Base | Score 5.3 (Integrity impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2026-91453[17]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | Lightweight HTTP Server). Supported versions that are affected are | Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, | 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; | Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable | vulnerability allows unauthenticated attacker with network access | via multiple protocols to compromise Oracle Java SE, Oracle GraalVM | for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of | this vulnerability can result in unauthorized update, insert or | delete access to some of Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition accessible data. Note: This | vulnerability can only be exploited by supplying data to APIs in the | specified Component without using Untrusted Java Web Start | applications or Untrusted Java applets, such as through a web | service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2026-91461[18]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | JSSE). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; | Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM | Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability | allows unauthenticated attacker with network access via TLS to | compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM | Enterprise Edition. Successful attacks of this vulnerability can | result in unauthorized update, insert or delete access to some of | Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise | Edition accessible data. Note: This vulnerability can only be | exploited by supplying data to APIs in the specified Component | without using Untrusted Java Web Start applications or Untrusted | Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 | (Integrity impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2026-91462[19]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | JGSS). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; | Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM | Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability | allows unauthenticated attacker with network access via multiple | protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition. Successful attacks of this | vulnerability can result in unauthorized creation, deletion or | modification access to critical data or all Oracle Java SE, Oracle | GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. | Note: This vulnerability can only be exploited by supplying data to | APIs in the specified Component without using Untrusted Java Web | Start applications or Untrusted Java applets, such as through a web | service. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). CVE-2026-91463[20]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | JGSS). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; | Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM | Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability | allows unauthenticated attacker with network access via multiple | protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition. Successful attacks require human | interaction from a person other than the attacker. Successful | attacks of this vulnerability can result in unauthorized access to | critical data or complete access to all Oracle Java SE, Oracle | GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. | Note: This vulnerability applies to Java deployments, typically in | clients running sandboxed Java Web Start applications or sandboxed | Java applets, that load and run untrusted code (e.g., code that | comes from the internet) and rely on the Java sandbox for security. | This vulnerability does not apply to Java deployments, typically in | servers, that load and run only trusted code (e.g., code installed | by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality | impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). CVE-2026-91464[21]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | JGSS). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; | Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM | Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability | allows unauthenticated attacker with network access via multiple | protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition. Successful attacks require human | interaction from a person other than the attacker. Successful | attacks of this vulnerability can result in unauthorized access to | critical data or complete access to all Oracle Java SE, Oracle | GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. | Note: This vulnerability applies to Java deployments, typically in | clients running sandboxed Java Web Start applications or sandboxed | Java applets, that load and run untrusted code (e.g., code that | comes from the internet) and rely on the Java sandbox for security. | This vulnerability does not apply to Java deployments, typically in | servers, that load and run only trusted code (e.g., code installed | by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality | impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). CVE-2026-91484[22]: | Vulnerability in Oracle Java SE (component: Java plugin). Supported | versions that are affected are Oracle Java SE: 8u503 and | 8u503-perf. Difficult to exploit vulnerability allows low privileged | attacker with logon to the infrastructure where Oracle Java SE | executes to compromise Oracle Java SE. While the vulnerability is | in Oracle Java SE, attacks may significantly impact additional | products (scope change). Successful attacks of this vulnerability | can result in unauthorized creation, deletion or modification | access to critical data or all Oracle Java SE accessible data as | well as unauthorized access to critical data or complete access to | all Oracle Java SE accessible data. Note: This vulnerability applies | to Java deployments, typically in clients running sandboxed Java Web | Start applications or sandboxed Java applets, that load and run | untrusted code (e.g., code that comes from the internet) and rely on | the Java sandbox for security. This vulnerability does not apply to | Java deployments, typically in servers, that load and run only | trusted code (e.g., code installed by an administrator). CVSS 3.1 | Base Score 7.5 (Confidentiality and Integrity impacts). CVSS | Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N). CVE-2026-83381[23]: | Vulnerability in Oracle Java SE (component: Security). Supported | versions that are affected are Oracle Java SE: 8u503, 8u503-perf, | 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for | JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: | 21.3.19.1.1. Difficult to exploit vulnerability allows | unauthenticated attacker with network access via multiple protocols | to compromise Oracle Java SE. Successful attacks of this | vulnerability can result in unauthorized update, insert or delete | access to some of Oracle Java SE accessible data as well as | unauthorized read access to a subset of Oracle Java SE accessible | data. Note: This vulnerability can be exploited by using APIs in the | specified Component, e.g., through a web service which supplies data | to the APIs. This vulnerability also applies to Java deployments, | typically in clients running sandboxed Java Web Start applications | or sandboxed Java applets, that load and run untrusted code (e.g., | code that comes from the internet) and rely on the Java sandbox for | security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity | impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). CVE-2026-83387[24]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | JDBC). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; | Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM | Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability | allows unauthenticated attacker with network access via multiple | protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition. Successful attacks of this | vulnerability can result in unauthorized access to critical data or | complete access to all Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition accessible data. Note: This | vulnerability can be exploited by using APIs in the specified | Component, e.g., through a web service which supplies data to the | APIs. This vulnerability also applies to Java deployments, typically | in clients running sandboxed Java Web Start applications or | sandboxed Java applets, that load and run untrusted code (e.g., code | that comes from the internet) and rely on the Java sandbox for | security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS | Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). CVE-2026-83395[25]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | Networking). Supported versions that are affected are Oracle Java | SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, | 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM | Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability | allows unauthenticated attacker with network access via multiple | protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition. Successful attacks of this | vulnerability can result in unauthorized update, insert or delete | access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition accessible data and unauthorized ability | to cause a partial denial of service (partial DOS) of Oracle Java | SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: | This vulnerability can be exploited by using APIs in the specified | Component, e.g., through a web service which supplies data to the | APIs. This vulnerability also applies to Java deployments, typically | in clients running sandboxed Java Web Start applications or | sandboxed Java applets, that load and run untrusted code (e.g., code | that comes from the internet) and rely on the Java sandbox for | security. CVSS 3.1 Base Score 6.5 (Integrity and Availability | impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). CVE-2026-83400[26]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | JAXP). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; | Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM | Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability | allows unauthenticated attacker with network access via multiple | protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition. Successful attacks of this | vulnerability can result in unauthorized ability to cause a partial | denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM | for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability | can be exploited by using APIs in the specified Component, e.g., | through a web service which supplies data to the APIs. This | vulnerability also applies to Java deployments, typically in clients | running sandboxed Java Web Start applications or sandboxed Java | applets, that load and run untrusted code (e.g., code that comes | from the internet) and rely on the Java sandbox for security. CVSS | 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). CVE-2026-87290[27]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | JAXP). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; | Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM | Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability | allows unauthenticated attacker with network access via multiple | protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition. Successful attacks of this | vulnerability can result in unauthorized access to critical data or | complete access to all Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition accessible data. Note: This | vulnerability can be exploited by using APIs in the specified | Component, e.g., through a web service which supplies data to the | APIs. This vulnerability also applies to Java deployments, typically | in clients running sandboxed Java Web Start applications or | sandboxed Java applets, that load and run untrusted code (e.g., code | that comes from the internet) and rely on the Java sandbox for | security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS | Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). CVE-2026-87292[28]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | Networking). Supported versions that are affected are Oracle Java | SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, | 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM | Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability | allows unauthenticated attacker with network access via multiple | protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition. Successful attacks of this | vulnerability can result in unauthorized update, insert or delete | access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition accessible data. Note: This vulnerability | can be exploited by using APIs in the specified Component, e.g., | through a web service which supplies data to the APIs. This | vulnerability also applies to Java deployments, typically in clients | running sandboxed Java Web Start applications or sandboxed Java | applets, that load and run untrusted code (e.g., code that comes | from the internet) and rely on the Java sandbox for security. CVSS | 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2026-87293[29]: | Vulnerability in Oracle Java SE (component: RMI). Supported | versions that are affected are Oracle Java SE: 8u503 and | 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. | Difficult to exploit vulnerability allows unauthenticated attacker | with network access via multiple protocols to compromise Oracle Java | SE. While the vulnerability is in Oracle Java SE, attacks may | significantly impact additional products (scope change). Successful | attacks of this vulnerability can result in unauthorized update, | insert or delete access to some of Oracle Java SE accessible data as | well as unauthorized read access to a subset of Oracle Java SE | accessible data. Note: This vulnerability can only be exploited by | supplying data to APIs in the specified Component without using | Untrusted Java Web Start applications or Untrusted Java applets, | such as through a web service. CVSS 3.1 Base Score 5.4 | (Confidentiality and Integrity impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N). CVE-2026-87294[30]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | Security). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; | Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM | Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability | allows unauthenticated attacker with network access via multiple | protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition. Successful attacks of this | vulnerability can result in unauthorized update, insert or delete | access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition accessible data as well as unauthorized | read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition accessible data. Note: This | vulnerability can be exploited by using APIs in the specified | Component, e.g., through a web service which supplies data to the | APIs. This vulnerability also applies to Java deployments, typically | in clients running sandboxed Java Web Start applications or | sandboxed Java applets, that load and run untrusted code (e.g., code | that comes from the internet) and rely on the Java sandbox for | security. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity | impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). CVE-2026-87367[31]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | JAXP). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; | Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM | Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability | allows unauthenticated attacker with network access via multiple | protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition. Successful attacks of this | vulnerability can result in unauthorized update, insert or delete | access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition accessible data. Note: This vulnerability | can be exploited by using APIs in the specified Component, e.g., | through a web service which supplies data to the APIs. This | vulnerability also applies to Java deployments, typically in clients | running sandboxed Java Web Start applications or sandboxed Java | applets, that load and run untrusted code (e.g., code that comes | from the internet) and rely on the Java sandbox for security. CVSS | 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2026-91332[32]: | Vulnerability in Oracle Java SE (component: Networking). Supported | versions that are affected are Oracle Java SE: 8u503-perf, | 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for | JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: | 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated | attacker with network access via multiple protocols to compromise | Oracle Java SE. Successful attacks of this vulnerability can result | in unauthorized update, insert or delete access to some of Oracle | Java SE accessible data. Note: This vulnerability can be exploited | by using APIs in the specified Component, e.g., through a web | service which supplies data to the APIs. This vulnerability also | applies to Java deployments, typically in clients running sandboxed | Java Web Start applications or sandboxed Java applets, that load and | run untrusted code (e.g., code that comes from the internet) and | rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 | (Integrity impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2026-91334[33]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | ImageIO). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; | Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM | Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability | allows unauthenticated attacker with network access via multiple | protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition. Successful attacks of this | vulnerability can result in unauthorized read access to a subset of | Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise | Edition accessible data. Note: This vulnerability can be exploited | by using APIs in the specified Component, e.g., through a web | service which supplies data to the APIs. This vulnerability also | applies to Java deployments, typically in clients running sandboxed | Java Web Start applications or sandboxed Java applets, that load and | run untrusted code (e.g., code that comes from the internet) and | rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 | (Confidentiality impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). CVE-2026-91335[34]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | AWT). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; | Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM | Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability | allows low privileged attacker with network access via multiple | protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition. Successful attacks require human | interaction from a person other than the attacker. Successful | attacks of this vulnerability can result in unauthorized read | access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition accessible data. Note: This vulnerability | applies to Java deployments, typically in clients running sandboxed | Java Web Start applications or sandboxed Java applets, that load and | run untrusted code (e.g., code that comes from the internet) and | rely on the Java sandbox for security. This vulnerability does not | apply to Java deployments, typically in servers, that load and run | only trusted code (e.g., code installed by an administrator). CVSS | 3.1 Base Score 2.6 (Confidentiality impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N). CVE-2026-91373[35]: | Vulnerability in Oracle Java SE (component: JSSE). Supported | versions that are affected are Oracle Java SE: 8u503, 8u503-perf, | 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: | 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: | 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated | attacker with network access via TLS to compromise Oracle Java SE. | Successful attacks of this vulnerability can result in unauthorized | ability to cause a partial denial of service (partial DOS) of Oracle | Java SE. Note: This vulnerability can be exploited by using APIs in | the specified Component, e.g., through a web service which supplies | data to the APIs. This vulnerability also applies to Java | deployments, typically in clients running sandboxed Java Web Start | applications or sandboxed Java applets, that load and run untrusted | code (e.g., code that comes from the internet) and rely on the Java | sandbox for security. CVSS 3.1 Base Score 5.3 (Availability | impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). CVE-2026-91374[36]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | Serviceability). Supported versions that are affected are Oracle | Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, | 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; | Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit | vulnerability allows unauthenticated attacker with network access | via multiple protocols to compromise Oracle Java SE, Oracle GraalVM | for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of | this vulnerability can result in unauthorized update, insert or | delete access to some of Oracle Java SE, Oracle GraalVM for JDK, | Oracle GraalVM Enterprise Edition accessible data as well as | unauthorized read access to a subset of Oracle Java SE, Oracle | GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. | Note: This vulnerability can be exploited by using APIs in the | specified Component, e.g., through a web service which supplies data | to the APIs. This vulnerability also applies to Java deployments, | typically in clients running sandboxed Java Web Start applications | or sandboxed Java applets, that load and run untrusted code (e.g., | code that comes from the internet) and rely on the Java sandbox for | security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity | impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). CVE-2026-91375[37]: | Vulnerability in Oracle Java SE (component: Libraries). Supported | versions that are affected are Oracle Java SE: 8u503-perf, | 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for | JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: | 21.3.19.1.1. Difficult to exploit vulnerability allows | unauthenticated attacker with logon to the infrastructure where | Oracle Java SE executes to compromise Oracle Java SE. Successful | attacks require human interaction from a person other than the | attacker. Successful attacks of this vulnerability can result in | unauthorized creation, deletion or modification access to critical | data or all Oracle Java SE accessible data. Note: This vulnerability | can be exploited by using APIs in the specified Component, e.g., | through a web service which supplies data to the APIs. This | vulnerability also applies to Java deployments, typically in clients | running sandboxed Java Web Start applications or sandboxed Java | applets, that load and run untrusted code (e.g., code that comes | from the internet) and rely on the Java sandbox for security. CVSS | 3.1 Base Score 4.7 (Integrity impacts). CVSS Vector: | (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N). CVE-2026-91379[38]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: JDK | tools). Supported versions that are affected are Oracle Java SE: | 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle | GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise | Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows | unauthenticated attacker with logon to the infrastructure where | Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise | Edition executes to compromise Oracle Java SE, Oracle GraalVM for | JDK, Oracle GraalVM Enterprise Edition. Successful attacks require | human interaction from a person other than the attacker. Successful | attacks of this vulnerability can result in unauthorized creation, | deletion or modification access to critical data or all Oracle Java | SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition | accessible data. Note: This vulnerability applies to Java | deployments, typically in clients running sandboxed Java Web Start | applications or sandboxed Java applets, that load and run untrusted | code (e.g., code that comes from the internet) and rely on the Java | sandbox for security. This vulnerability does not apply to Java | deployments, typically in servers, that load and run only trusted | code (e.g., code installed by an administrator). CVSS 3.1 Base Score | 4.7 (Integrity impacts). CVSS Vector: | (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N). CVE-2026-91380[39]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | Utility). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; | Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM | Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability | allows unauthenticated attacker with logon to the infrastructure | where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM | Enterprise Edition executes to compromise Oracle Java SE, Oracle | GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful | attacks of this vulnerability can result in unauthorized update, | insert or delete access to some of Oracle Java SE, Oracle GraalVM | for JDK, Oracle GraalVM Enterprise Edition accessible data as well | as unauthorized read access to a subset of Oracle Java SE, Oracle | GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. | Note: This vulnerability can be exploited by using APIs in the | specified Component, e.g., through a web service which supplies data | to the APIs. This vulnerability also applies to Java deployments, | typically in clients running sandboxed Java Web Start applications | or sandboxed Java applets, that load and run untrusted code (e.g., | code that comes from the internet) and rely on the Java sandbox for | security. CVSS 3.1 Base Score 4.0 (Confidentiality and Integrity | impacts). CVSS Vector: | (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). CVE-2026-91381[40]: | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise | Edition product of Oracle Java SE (component: 2D). Supported | versions that are affected are Oracle Java SE: 8u503 and | 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. | Difficult to exploit vulnerability allows unauthenticated attacker | with network access via multiple protocols to compromise Oracle Java | SE, Oracle GraalVM Enterprise Edition. Successful attacks of this | vulnerability can result in unauthorized update, insert or delete | access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition | accessible data. Note: This vulnerability can be exploited by using | APIs in the specified Component, e.g., through a web service which | supplies data to the APIs. This vulnerability also applies to Java | deployments, typically in clients running sandboxed Java Web Start | applications or sandboxed Java applets, that load and run untrusted | code (e.g., code that comes from the internet) and rely on the Java | sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). | CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2026-91382[41]: | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition product of Oracle Java SE (component: | 2D). Supported versions that are affected are Oracle Java SE: | 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1; Oracle GraalVM for JDK: | 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: | 21.3.19.1.1. Difficult to exploit vulnerability allows | unauthenticated attacker with network access via multiple protocols | to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM | Enterprise Edition. Successful attacks of this vulnerability can | result in unauthorized creation, deletion or modification access to | critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle | GraalVM Enterprise Edition accessible data and unauthorized ability | to cause a partial denial of service (partial DOS) of Oracle Java | SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: | This vulnerability can be exploited by using APIs in the specified | Component, e.g., through a web service which supplies data to the | APIs. This vulnerability also applies to Java deployments, typically | in clients running sandboxed Java Web Start applications or | sandboxed Java applets, that load and run untrusted code (e.g., code | that comes from the internet) and rely on the Java sandbox for | security. CVSS 3.1 Base Score 6.5 (Integrity and Availability | impacts). CVSS Vector: | (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L). https://openjdk.org/groups/vulnerability/advisories/2026-10-21 If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-91395 https://www.cve.org/CVERecord?id=CVE-2026-91395 [1] https://security-tracker.debian.org/tracker/CVE-2026-91396 https://www.cve.org/CVERecord?id=CVE-2026-91396 [2] https://security-tracker.debian.org/tracker/CVE-2026-91397 https://www.cve.org/CVERecord?id=CVE-2026-91397 [3] https://security-tracker.debian.org/tracker/CVE-2026-91398 https://www.cve.org/CVERecord?id=CVE-2026-91398 [4] https://security-tracker.debian.org/tracker/CVE-2026-91400 https://www.cve.org/CVERecord?id=CVE-2026-91400 [5] https://security-tracker.debian.org/tracker/CVE-2026-83374 https://www.cve.org/CVERecord?id=CVE-2026-83374 [6] https://security-tracker.debian.org/tracker/CVE-2026-91487 https://www.cve.org/CVERecord?id=CVE-2026-91487 [7] https://security-tracker.debian.org/tracker/CVE-2026-83376 https://www.cve.org/CVERecord?id=CVE-2026-83376 [8] https://security-tracker.debian.org/tracker/CVE-2026-83380 https://www.cve.org/CVERecord?id=CVE-2026-83380 [9] https://security-tracker.debian.org/tracker/CVE-2026-91403 https://www.cve.org/CVERecord?id=CVE-2026-91403 [10] https://security-tracker.debian.org/tracker/CVE-2026-91410 https://www.cve.org/CVERecord?id=CVE-2026-91410 [11] https://security-tracker.debian.org/tracker/CVE-2026-91411 https://www.cve.org/CVERecord?id=CVE-2026-91411 [12] https://security-tracker.debian.org/tracker/CVE-2026-91415 https://www.cve.org/CVERecord?id=CVE-2026-91415 [13] https://security-tracker.debian.org/tracker/CVE-2026-91417 https://www.cve.org/CVERecord?id=CVE-2026-91417 [14] https://security-tracker.debian.org/tracker/CVE-2026-91418 https://www.cve.org/CVERecord?id=CVE-2026-91418 [15] https://security-tracker.debian.org/tracker/CVE-2026-91451 https://www.cve.org/CVERecord?id=CVE-2026-91451 [16] https://security-tracker.debian.org/tracker/CVE-2026-91452 https://www.cve.org/CVERecord?id=CVE-2026-91452 [17] https://security-tracker.debian.org/tracker/CVE-2026-91453 https://www.cve.org/CVERecord?id=CVE-2026-91453 [18] https://security-tracker.debian.org/tracker/CVE-2026-91461 https://www.cve.org/CVERecord?id=CVE-2026-91461 [19] https://security-tracker.debian.org/tracker/CVE-2026-91462 https://www.cve.org/CVERecord?id=CVE-2026-91462 [20] https://security-tracker.debian.org/tracker/CVE-2026-91463 https://www.cve.org/CVERecord?id=CVE-2026-91463 [21] https://security-tracker.debian.org/tracker/CVE-2026-91464 https://www.cve.org/CVERecord?id=CVE-2026-91464 [22] https://security-tracker.debian.org/tracker/CVE-2026-91484 https://www.cve.org/CVERecord?id=CVE-2026-91484 [23] https://security-tracker.debian.org/tracker/CVE-2026-83381 https://www.cve.org/CVERecord?id=CVE-2026-83381 [24] https://security-tracker.debian.org/tracker/CVE-2026-83387 https://www.cve.org/CVERecord?id=CVE-2026-83387 [25] https://security-tracker.debian.org/tracker/CVE-2026-83395 https://www.cve.org/CVERecord?id=CVE-2026-83395 [26] https://security-tracker.debian.org/tracker/CVE-2026-83400 https://www.cve.org/CVERecord?id=CVE-2026-83400 [27] https://security-tracker.debian.org/tracker/CVE-2026-87290 https://www.cve.org/CVERecord?id=CVE-2026-87290 [28] https://security-tracker.debian.org/tracker/CVE-2026-87292 https://www.cve.org/CVERecord?id=CVE-2026-87292 [29] https://security-tracker.debian.org/tracker/CVE-2026-87293 https://www.cve.org/CVERecord?id=CVE-2026-87293 [30] https://security-tracker.debian.org/tracker/CVE-2026-87294 https://www.cve.org/CVERecord?id=CVE-2026-87294 [31] https://security-tracker.debian.org/tracker/CVE-2026-87367 https://www.cve.org/CVERecord?id=CVE-2026-87367 [32] https://security-tracker.debian.org/tracker/CVE-2026-91332 https://www.cve.org/CVERecord?id=CVE-2026-91332 [33] https://security-tracker.debian.org/tracker/CVE-2026-91334 https://www.cve.org/CVERecord?id=CVE-2026-91334 [34] https://security-tracker.debian.org/tracker/CVE-2026-91335 https://www.cve.org/CVERecord?id=CVE-2026-91335 [35] https://security-tracker.debian.org/tracker/CVE-2026-91373 https://www.cve.org/CVERecord?id=CVE-2026-91373 [36] https://security-tracker.debian.org/tracker/CVE-2026-91374 https://www.cve.org/CVERecord?id=CVE-2026-91374 [37] https://security-tracker.debian.org/tracker/CVE-2026-91375 https://www.cve.org/CVERecord?id=CVE-2026-91375 [38] https://security-tracker.debian.org/tracker/CVE-2026-91379 https://www.cve.org/CVERecord?id=CVE-2026-91379 [39] https://security-tracker.debian.org/tracker/CVE-2026-91380 https://www.cve.org/CVERecord?id=CVE-2026-91380 [40] https://security-tracker.debian.org/tracker/CVE-2026-91381 https://www.cve.org/CVERecord?id=CVE-2026-91381 [41] https://security-tracker.debian.org/tracker/CVE-2026-91382 https://www.cve.org/CVERecord?id=CVE-2026-91382 Please adjust the affected versions in the BTS as needed.
