CVE-2024-21144

What it actually does

Race condition in the concurrency component allows an unauthenticated network attacker to trigger a partial denial of service condition.

Why it matters to the business

May cause intermittent availability disruptions in Java-based client applications that process untrusted code, increasing operational overhead for organizations relying on widespread Java deployments.

How an attack unfolds

An attacker with network access crafts and sends multiple concurrent requests over supported protocols to trigger the race condition in Java concurrency handling, resulting in partial denial of service. The attack is difficult to execute reliably due to high complexity and applies primarily to sandboxed client environments running untrusted code.

How to fix it

Apply the latest Oracle security updates to upgrade Oracle Java SE beyond 8u411, 8u411-perf, and 11.0.23 and Oracle GraalVM Enterprise Edition beyond 20.3.14 and 21.3.10.

How to confirm the fix worked

Confirm Java runtime versions are updated past the affected releases and conduct application testing to verify absence of partial denial-of-service symptoms under concurrent load.

Typical attack path

1. Identify a target Java deployment accepting network connections via multiple protocols
2. Craft and transmit concurrent requests designed to exploit the race condition
3. Trigger partial denial of service affecting availability

How to detect it

Examine Java application and system logs for patterns of unexpected concurrency errors or partial service degradation coinciding with high volumes of network requests.

What your security team should do

• Prioritize patching all affected Java SE and GraalVM installations
• Limit network exposure of Java client environments handling untrusted code
• Review sandbox configurations and monitor for availability anomalies