CVE-2022-21366

What it actually does

Unauthenticated network attacker can supply crafted image data via ImageIO APIs over multiple protocols to trigger a partial denial of service condition that reduces availability of the affected Java runtime without requiring authentication or user interaction.

Why it matters to the business

Disruption of Java-based services and applications across a wide range of enterprise products including Oracle JDK/JRE, GraalVM, multiple NetApp management and storage tools, Debian Linux, and downstream dependents can lead to intermittent outages in image-processing workflows and client-side sandboxed applications.

How an attack unfolds

An attacker identifies a reachable Java deployment that processes untrusted image data through ImageIO, crafts a malformed image payload, and sends it over an allowed network protocol or API call to cause the partial availability impact; no authentication or user interaction is required.

How to fix it

Apply the latest vendor security updates for Oracle Java SE, GraalVM Enterprise Edition, and all affected downstream products such as NetApp tools and Debian packages; remove or restrict exposure of sandboxed Java Web Start or applet deployments that load untrusted code.

How to confirm the fix worked

Verify that affected Java versions have been replaced with patched releases, confirm ImageIO-related services no longer process untrusted inputs from unpatched runtimes, and retest availability under simulated malformed image loads.

Typical attack path

1. Locate exposed Java runtime or application using ImageIO for image handling
2. Craft malicious image data targeting the vulnerable ImageIO component
3. Deliver payload via network protocol or direct API invocation supplying untrusted data
4. Trigger partial denial of service affecting availability

How to detect it

Review application and Java runtime logs for repeated ImageIO processing failures or availability anomalies on systems accepting external image data; correlate with network traffic containing unusual image payloads delivered to Java endpoints.

What your security team should do

• Prioritize patching Oracle Java SE 11.0.13 and 17.0.1 plus GraalVM 20.3.4 and 21.3.0 instances first due to broad downstream impact
• Inventory all NetApp, Debian, and other listed affected products for coordinated upgrades
• Restrict network exposure of Java services that accept untrusted image data until patched
• Monitor EPSS and KEV status for any future increase in exploit activity