CVE-2025-30698

What it actually does

The flaw in the 2D component permits an unauthenticated network attacker to achieve unauthorized data modification, limited data disclosure, and partial denial of service via crafted input over multiple protocols in sandboxed Java deployments.

Why it matters to the business

Organizations running affected Java client environments may face limited data tampering or leakage and application disruptions when processing untrusted code, increasing operational risk for internet-facing sandboxed applications.

How an attack unfolds

An attacker identifies a vulnerable Java deployment executing sandboxed untrusted code and sends specially crafted network input targeting the 2D component to bypass input validation and obtain partial unauthorized access.

How to fix it

Apply vendor updates to Oracle Java SE versions beyond 8u441, 11.0.26, 17.0.14, 21.0.6, or 24 and GraalVM equivalents; for the listed package upgrade python3.11-urllib3 to 1.26.12-5.el8_10 or newer.

How to confirm the fix worked

Verify installed Java and GraalVM versions against the fixed releases; confirm the python3.11-urllib3 package reports version 1.26.12-5.el8_10 or later via package management tools.

Typical attack path

1. Locate Java client environments running sandboxed applets or Web Start applications
2. Craft malicious input exploiting the 2D validation weakness
3. Deliver payload over supported network protocols
4. Trigger unauthorized data changes, reads, and partial service impact

How to detect it

Examine network and application logs for unusual 2D component activity or unexpected data access patterns in sandboxed Java processes; no specific post-exploitation artifacts are known.

What your security team should do

• Prioritize patching internet-exposed sandboxed Java deployments within standard change windows
• Review and restrict Java Web Start or applet usage where feasible
• Monitor EPSS trend and reassess if exploitation maturity increases