CVE-2022-21341

What it actually does

The flaw in the Serialization component permits unauthenticated network attackers to submit crafted serialized data that triggers a partial denial of service condition, affecting availability without requiring authentication or user interaction.

Why it matters to the business

Organizations running affected Java deployments may experience intermittent service disruptions or reduced performance in client-side or API-exposed applications that process untrusted data, increasing operational overhead until patches are applied.

How an attack unfolds

An attacker with network reachability identifies Java endpoints accepting serialized input via protocols or APIs, crafts a malicious object that exploits the deserialization path, and transmits it to induce partial resource exhaustion or instability in the runtime.

How to fix it

Apply the latest Oracle Java SE and GraalVM updates that address the serialization issue; remove or restrict exposure of sandboxed Java Web Start, applets, or public APIs that accept untrusted serialized data; monitor Oracle release notes for subsequent security updates.

How to confirm the fix worked

Verify installed Java versions against the affected list (7u321, 8u311, 11.0.13, 17.0.1 and equivalent GraalVM releases); test endpoints with benign serialized payloads to confirm no unexpected partial service impact; review application logs for deserialization-related exceptions after updates.

Typical attack path

1. Scan for publicly reachable Java SE or GraalVM instances accepting network input over multiple protocols
2. Craft and send a malicious serialized payload targeting the Serialization component
3. Trigger the vulnerability to cause partial denial of service without authentication
4. Repeat or sustain requests to maintain availability impact on affected deployments

How to detect it

Examine Java application and web server logs for repeated deserialization errors or unexpected partial service degradation originating from external network sources; correlate with network flow data showing high volumes of requests to serialization-handling endpoints.

What your security team should do

• Prioritize upgrading all Oracle Java SE and GraalVM installations to non-affected releases as soon as possible
• Limit network exposure of Java applications that load untrusted code or accept serialized data from external sources
• Implement network segmentation and input validation controls around serialization APIs
• Review downstream dependencies in products such as NetApp tools and Debian packages for coordinated updates