CVE-2022-21626

What it actually does

The flaw permits an unauthenticated network attacker to trigger a partial denial of service against the Java Security component by supplying malicious input through HTTPS or via APIs used by sandboxed applets and web services.

Why it matters to the business

Organizations running affected Java runtimes may experience intermittent service disruptions that affect application availability and user access without data loss or unauthorized access.

How an attack unfolds

An attacker reaches a vulnerable Java deployment over the network, supplies crafted data to sandboxed code or exposed APIs, and causes the targeted component to degrade availability; the attack does not require authentication or user interaction.

How to fix it

Upgrade Oracle Java SE to versions later than 8u345-perf or 11.0.16.1 and GraalVM Enterprise Edition to versions later than 20.3.7, 21.3.3, or 22.2.0. Apply vendor patches for all listed downstream products as soon as they become available and remove or isolate any remaining vulnerable runtimes.

How to confirm the fix worked

Confirm that only patched Java versions are present in the environment, re-test affected services with the vendor-supplied validation cases, and verify that sandboxed applications no longer exhibit the partial DoS condition when supplied with the original proof-of-concept input.

Typical attack path

1. Identify publicly reachable Java endpoints or services that accept untrusted code or API calls over HTTPS
2. Craft and send malicious input designed to exercise the vulnerable Security component
3. Observe partial denial-of-service behavior that reduces service responsiveness
4. Repeat or sustain the traffic to prolong availability impact

How to detect it

Review web server and application logs for repeated HTTPS requests that produce elevated error rates or thread exhaustion tied to the Java Security component; correlate with network flow data showing high-volume connections from single sources to Java endpoints.

What your security team should do

• Prioritize patching of internet-facing or high-value Java deployments within the next maintenance window
• Inventory all Oracle JDK, JRE, and GraalVM instances across the estate and map them to fixed releases
• Disable or sandbox Java Web Start and applet execution where business needs permit
• Monitor EPSS trend and any new exploit publications given the 27% score increase over 30 days