CVE-2025-30754

What it actually does

Flaw in JSSE TLS handling permits an unauthenticated remote attacker to achieve limited unauthorized read and modification of accessible data when the Java deployment processes untrusted code under the sandbox.

Why it matters to the business

Organizations running affected Java versions on client-side sandboxed applications face risk of data leakage or tampering in environments that execute code from the internet; servers executing only trusted code are unaffected. The low EPSS and absence from KEV reduce immediate urgency, yet the 470-day window since publication warrants prompt patching of the supplied linux-lts stream.

How an attack unfolds

An attacker positions a malicious TLS endpoint and waits for a vulnerable Java client (sandboxed applet or Web Start application) to connect; successful exploitation of the JSSE weakness then grants limited read and write access to data reachable by the sandboxed code.

How to fix it

Upgrade linux-lts (Alpaquita:stream) to version 6.6.58-r0 or later; apply corresponding Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition updates that resolve the JSSE issue. Disable sandboxed execution of untrusted code where feasible.

How to confirm the fix worked

Confirm the installed package version meets or exceeds 6.6.58-r0; verify Java runtime version strings no longer match the listed vulnerable releases; re-test TLS client connections with untrusted code under the sandbox to ensure the described data-access behavior is absent.

Typical attack path

1. Identify or lure a target running a vulnerable Oracle Java SE / GraalVM deployment that loads untrusted code via TLS.
2. Serve or intercept a TLS session from a controlled network location.
3. Trigger the JSSE cryptographic weakness to obtain limited unauthorized data access or modification within the sandbox.
4. Leverage the resulting read or write capability to exfiltrate or alter accessible application data.

How to detect it

Review TLS connection logs and Java sandbox audit trails for unexpected outbound connections initiated by client-side Java processes; inspect for anomalous data-access patterns in sandboxed applications after TLS handshakes.

What your security team should do

• Prioritize upgrade of linux-lts (Alpaquita:stream) to 6.6.58-r0 within change windows.
• Inventory all Java deployments and segregate those executing untrusted code.
• Apply vendor patches for Oracle Java SE 8u451+, 11.0.27+, 17.0.15+, 21.0.7+, 24.0.1+ and matching GraalVM releases.
• Review sandbox policies and consider disabling Java Web Start or applets that load remote code.
• Monitor EPSS trend; reassess if score rises above 0.01.