CVE-2026-47057

What it actually does

Unauthenticated network attacker can trigger a hang or repeatable crash in the Scripting component of affected Java SE versions by supplying malicious data via multiple protocols or by loading untrusted code into sandboxed environments, resulting in complete denial of service with no impact on confidentiality or integrity.

Why it matters to the business

Java-based applications and services on Red Hat systems can experience sudden unavailability and repeated crashes, leading to operational downtime, disrupted workloads, and potential loss of revenue or service-level compliance until the affected deployments are updated.

How an attack unfolds

An attacker identifies a reachable Java deployment and sends crafted input through exposed APIs or web services that invoke the Scripting component, or supplies untrusted code that runs in a sandboxed Java environment, causing the JVM to hang or crash without requiring credentials.

How to fix it

Upgrade to the fixed package versions provided in RHSA-2026:42882: java-11-openjdk on EL7/EL8/EL9 to 11.0.32.0.9-1, java-1.8.0-openjdk on EL7/EL8/EL9 to 1.8.0.502.b07-1.1, java-1.8.0-ibm on EL8 to 1.8.0.8.70-1.el8_10, and the corresponding openjdk-windows and openjdk-portable fixes for other variants.

How to confirm the fix worked

Verify installed package versions against the RHSA-2026:42882 fixed releases, confirm removal of vulnerable 8u491/11.0.31 builds, and perform functional testing to ensure scripting and network-exposed APIs no longer induce hangs or crashes under load.

Typical attack path

1. Scan for network-accessible Java deployments exposing scripting or API endpoints
2. Craft and transmit malicious payloads via supported protocols to trigger the flaw
3. Load untrusted code from external sources into sandboxed applets or Web Start applications
4. Observe repeated JVM hangs or crashes resulting in denial of service

How to detect it

Review Java process and system logs for repeated JVM crashes or hang indicators around the time of suspected incidents, correlate with network traffic to scripting endpoints, and inspect sandboxed application execution traces for untrusted code loads that coincide with availability loss.

What your security team should do

• Apply the listed RHSA-2026:42882 updates to all affected Red Hat Java packages within the next maintenance window
• Restrict network exposure of Java APIs and disable unnecessary scripting functionality where possible
• Monitor Java process stability logs for crash patterns during the transition period
• Review downstream application dependencies on the vulnerable Java versions and schedule coordinated upgrades