Cloudanix VulnDB

CVE-2026-91410

Medium · 5.3

CVSS

5.3

EPSS

0.3%

Published

Oct 20, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in widely used Java software lets remote attackers slow down or partially disable applications without needing any login credentials.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unauthenticated network attacker can trigger a partial denial of service condition against the Java runtime by supplying specially crafted data to APIs in the Libraries component over multiple protocols.

Why it matters to the business

Java-based applications and services may experience intermittent unavailability, increasing operational overhead and potentially affecting customer-facing systems until the issue is addressed.

How an attack unfolds

An attacker with network reachability crafts input that exercises vulnerable code paths in the Libraries component; because the flaw requires no authentication or user interaction, the attacker can repeatedly submit the triggering data to degrade availability.

How to fix it

Apply the latest available Oracle Java SE, GraalVM, or GraalVM Enterprise Edition updates that resolve the Libraries component issue; test in a non-production environment first and schedule rollout according to change-management processes.

How to confirm the fix worked

Confirm the Java runtime reports an updated build number after patching, then exercise the previously affected APIs with known trigger patterns under load to verify that partial DoS behavior no longer occurs.

Typical attack path

  1. Identify reachable Java endpoints or services accepting untrusted input via the Libraries component.
  2. Craft and transmit malformed data using any supported protocol or API entry point.
  3. Observe partial service degradation or resource exhaustion on the target Java process.
  4. Repeat the request pattern to sustain the availability impact.

How to detect it

Inspect application and JVM logs for sudden spikes in exceptions or resource-utilization warnings coinciding with external traffic; correlate with network flow data showing repeated requests to Java endpoints from untrusted sources.

What your security team should do

  • Prioritize patching of internet-facing or high-traffic Java deployments within the next maintenance window.
  • Review and restrict unnecessary network exposure of Java services where possible.
  • Monitor vendor release notes for the exact fixed build numbers once published.

The record

Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities