CVE-2025-50059

What it actually does

The Networking component flaw permits an unauthenticated remote attacker to read critical or all accessible data in affected Java deployments, with a scope change that extends impact beyond the vulnerable component.

Why it matters to the business

Client environments executing sandboxed untrusted code face exposure of sensitive data; server deployments running only trusted code are unaffected. Low EPSS and absence from KEV indicate limited active exploitation risk despite the high confidentiality impact.

How an attack unfolds

An attacker sends specially crafted network traffic over multiple protocols to a vulnerable Java client process that loads and runs untrusted code from the internet, bypassing sandbox protections to exfiltrate data.

How to fix it

Upgrade affected packages to the listed fixed versions: linux-lts (Alpaquita:stream) to 6.6.58-r0 or 6.12.41-r0; linux-lts (Alpaquita:23) to 6.1.68-r0; linux-lts (Alpaquita:25) to 6.12.41-r0. Restrict untrusted code execution where possible and apply vendor patches for Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition.

How to confirm the fix worked

Confirm installed Java and package versions match or exceed the fixed releases; test that sandboxed client applications no longer permit unauthorized data reads over network inputs.

Typical attack path

1. Locate Java deployments running affected versions that execute sandboxed untrusted code
2. Send malicious network payloads via supported protocols to trigger the networking flaw
3. Leverage scope change to access data outside the intended component boundary
4. Exfiltrate critical or all accessible data

How to detect it

Review network logs and Java process activity for unexpected outbound data transfers initiated from sandboxed client applications; correlate with connections to external hosts over multiple protocols.

What your security team should do

• Apply the exact fixed package versions immediately on all Alpaquita linux-lts systems
• Audit client Java deployments for sandboxed untrusted code execution
• Disable network access for Java processes handling untrusted code until patched
• Monitor EPSS trend and re-evaluate if exploit maturity increases