Cloudanix VulnDB

CVE-2026-91373

Medium · 5.3

CVSS

5.3

EPSS

0.4%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in Java's secure connection handling lets remote attackers partially slow down or disable services that use encrypted network links without any login required.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A flaw in the JSSE component permits an unauthenticated network attacker to trigger a partial denial of service condition over TLS by supplying crafted data to exposed APIs.

Why it matters to the business

Java-based services handling TLS connections may suffer intermittent availability degradation, leading to slower response times or partial outages for users and dependent systems.

How an attack unfolds

An attacker with network reachability sends specially formed TLS records to a Java process exposing JSSE APIs, causing resource exhaustion that results in partial denial of service; the same vector works against sandboxed Java clients loading remote code.

How to fix it

Upgrade Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition to the latest vendor-supplied versions that resolve the JSSE issue.

How to confirm the fix worked

Confirm the installed Java runtime version is newer than all listed affected releases, then perform functional TLS connection tests to verify absence of the partial DoS condition.

Typical attack path

  1. Locate a Java application or service exposing JSSE over TLS
  2. Craft a TLS handshake or record payload that triggers the flaw
  3. Transmit the payload from an unauthenticated network position
  4. Observe partial service degradation or error conditions

How to detect it

Inspect application and TLS layer logs for sudden spikes in handshake failures or partial connection resets that coincide with increased error rates; no public exploitation artifacts are known at this time.

What your security team should do

  • Prioritize patching all internet-facing and internal Java runtimes within the next maintenance window
  • Inventory applications and containers that bundle the affected Java versions
  • Temporarily restrict untrusted TLS clients if immediate patching is not feasible

The record

Vulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities