CVE-2022-21360

What it actually does

Flaw in the ImageIO component permits an unauthenticated network attacker to trigger a partial denial of service condition against the Java runtime.

Why it matters to the business

Services that process untrusted image data or expose Java APIs over the network may experience intermittent availability issues, increasing operational overhead until patched.

How an attack unfolds

An attacker sends crafted data through supported protocols or APIs to the vulnerable ImageIO code path; the defect is triggered in sandboxed or web-service contexts that accept external input, resulting in partial service degradation.

How to fix it

Upgrade cla-assistant to commit 09a5023adc6c56a10d56e56911bc81e96d991282 or later; for underlying Oracle Java SE and GraalVM deployments apply the vendor-supplied patches that supersede the listed vulnerable versions.

How to confirm the fix worked

Confirm the running Java and GraalVM versions are newer than the affected releases and that cla-assistant is at or beyond the referenced commit; test ImageIO processing with untrusted inputs to verify absence of the partial DoS condition.

Typical attack path

1. Locate services exposing the affected Java versions or dependent applications
2. Prepare malicious input targeting the ImageIO component
3. Deliver the payload over network protocols or via web-service APIs
4. Observe partial denial-of-service impact on availability

How to detect it

Inspect application and Java runtime logs for repeated ImageIO processing failures or partial service degradation events correlated with external network requests.

What your security team should do

• Apply the listed commit or newer Java patches immediately given the long publication window
• Restrict exposure of ImageIO-dependent endpoints to trusted sources where feasible
• Review application logs for ImageIO-related errors after patching