CVE-2022-21277

What it actually does

The flaw permits an unauthenticated network attacker to supply crafted image data to the ImageIO component, triggering a partial denial of service that affects availability of the Java process.

Why it matters to the business

Java-based services handling untrusted images can experience intermittent outages, increasing operational load and potentially disrupting client-facing applications that rely on sandboxed execution.

How an attack unfolds

An attacker sends specially formed image payloads over network protocols to any exposed Java deployment that invokes ImageIO APIs with untrusted input, causing the target process to degrade without requiring authentication or user interaction.

How to fix it

Apply the latest vendor updates for Oracle Java SE and GraalVM Enterprise Edition that address the ImageIO component; where immediate patching is not feasible, restrict untrusted image processing or isolate affected services.

How to confirm the fix worked

Confirm deployed Java versions are newer than the affected releases, review change logs for ImageIO fixes, and perform functional testing with known-malicious image samples in a controlled environment.

Typical attack path

1. Identify reachable Java deployments that process external image data via ImageIO
2. Craft and transmit malicious image content over supported network protocols
3. Trigger ImageIO parsing in the target process
4. Induce partial denial of service affecting availability

How to detect it

Review application and Java runtime logs for unexpected ImageIO exceptions or resource exhaustion events correlated with inbound image traffic; examine web or API access logs for repeated requests carrying image payloads to affected endpoints.

What your security team should do

• Prioritize patching of internet-facing or multi-tenant Java runtimes first
• Inventory all instances of Oracle JDK, JRE, GraalVM, and downstream products listed as affected
• Implement network segmentation or input sanitization for image-handling code paths until patches are applied
• Monitor vendor advisories for subsequent GraalVM and JDK releases