CVE-2022-21293

What it actually does

Vulnerability in the Libraries component of Oracle Java SE and GraalVM allows unauthenticated network attackers to trigger a partial denial of service condition through crafted inputs supplied via multiple protocols or direct API calls, affecting sandboxed executions of untrusted code.

Why it matters to the business

Organizations relying on the listed Java versions across Oracle, Debian, Fedora, and NetApp products face availability disruptions that can interrupt client-facing applications, web services, and internal tools processing external data, with elevated urgency due to widespread ecosystem prevalence and stable but non-zero exploitation probability.

How an attack unfolds

An attacker with network reachability identifies exposed Java deployments running affected versions, supplies malicious data through supported protocols or web services invoking the Libraries APIs, and triggers the flaw to produce partial denial of service without authentication or user interaction.

How to fix it

Upgrade Oracle Java SE beyond the affected releases (7u321, 8u311, 11.0.13, 17.0.1) and GraalVM Enterprise Edition beyond 20.3.4 and 21.3.0; apply the latest vendor security updates to all dependent products including NetApp components and operating system packages.

How to confirm the fix worked

Confirm running Java versions exceed the affected list, execute regression tests with untrusted code samples, and monitor for absence of partial DoS symptoms under load.

Typical attack path

1. Map network-accessible Java services or applets on affected versions
2. Craft and transmit malicious payloads via HTTP, RMI, or other supported protocols
3. Invoke vulnerable Libraries APIs directly or through untrusted code loaded in the sandbox
4. Induce partial service degradation or resource exhaustion

How to detect it

Examine application and system logs for repeated partial service failures or resource exhaustion events tied to Java library processing; review network traffic for anomalous patterns targeting Java endpoints on systems running the listed versions.

What your security team should do

• Immediately inventory all Oracle JDK, JRE, GraalVM, and NetApp deployments for affected versions
• Apply vendor patches or migrate to supported Java releases within the next maintenance window
• Restrict network exposure of Java services accepting untrusted input
• Update EPSS monitoring to track any future score increases given the 1733-day publication age