CVE-2025-30691

What it actually does

The flaw in the Compiler component permits an unauthenticated network attacker to bypass authorization checks, resulting in unauthorized update/insert/delete operations on some accessible data and read access to a subset of data when invoked via exposed APIs or web services supplying data to those APIs.

Why it matters to the business

Organizations running the affected Java deployments face risk of partial data tampering and leakage that could affect compliance, data integrity, and operations, although exploitation difficulty and low EPSS limit immediate widespread impact; 561 days have passed since publication with minimal EPSS growth.

How an attack unfolds

An attacker identifies network-accessible Java services or sandboxed applications that invoke the Compiler component, supplies crafted data through multiple protocols or untrusted code, and leverages the authorization bypass to perform limited unauthorized data modifications and reads.

How to fix it

Apply the following updates immediately: gstreamer1-plugins-base (Red Hat:rhel_aus:8.4::appstream): fixed in 0:1.16.1-3.el8_4 and equivalent packages on rhel_e4s and rhel_tus; Oracle Java SE 21.0.6 and 24 users should obtain the corresponding Oracle Critical Patch Update for the Java Compiler component.

How to confirm the fix worked

Verify Java and GraalVM installations report versions beyond 21.0.6 and 24, confirm Compiler-related API endpoints no longer permit unauthorized data operations via targeted test cases, and review package manifests to ensure listed Red Hat GStreamer packages are at the stated fixed versions.

Typical attack path

1. Locate exposed Java SE or GraalVM endpoints accepting API or web service input
2. Send specially crafted requests targeting the Compiler component
3. Bypass authorization to achieve limited data read and modification

How to detect it

Review application and web server logs for unusual sequences of API calls to the Compiler component, inspect sandboxed Java Web Start or applet execution traces for unexpected data modification attempts, and correlate with network traffic showing repeated connections from untrusted sources.

What your security team should do

• Prioritize patching affected Oracle Java SE and GraalVM instances per the published fixed versions
• Audit all network-exposed Java services and sandboxed applications that invoke the Compiler component
• Monitor EPSS trend and re-evaluate if exploit maturity changes given the 561-day window since disclosure