Skip to main content

Oracle Java SE CVE-2026-22021

| EUVDEUVD-2026-24335 MEDIUM
Uncontrolled Resource Consumption (CWE-400)
2026-04-21 oracle
Denial Of Service Java Oracle Oracle Java Se Oracle Graalvm Enterprise Edition Oracle Graalvm For Jdk Oracle Corporation
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vuln.today AI
5.3 MEDIUM

Network-reachable HTTPS endpoint with no auth required; only partial availability impact and no confidentiality or integrity effects, matching description exactly.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.3 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 06:31 vuln.today
Patch released
Apr 28, 2026 - 08:30 nvd
Patch available
EUVD ID Assigned
Apr 21, 2026 - 21:01 euvd
EUVD-2026-24335
CVE Published
Apr 21, 2026 - 20:35 nvd
MEDIUM 5.3

DescriptionCVE.org

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

AnalysisAI

Uncontrolled resource consumption in Oracle Java SE's JSSE (Java Secure Socket Extension) component allows unauthenticated remote attackers to cause partial denial of service against HTTPS-enabled Java services and GraalVM deployments. Affected versions span all major Java SE release trains from 8u481 through 26, as well as GraalVM for JDK and GraalVM Enterprise Edition. Oracle confirmed the vulnerability in the April 2026 Critical Patch Update; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

JSSE is Oracle's implementation of the SSL and TLS protocols within the Java platform, responsible for handling secure HTTPS connections at the socket layer. CWE-400 (Uncontrolled Resource Consumption) indicates that maliciously crafted TLS/HTTPS input can cause the JSSE component to consume disproportionate memory, CPU, or connection slots without adequate bounds checking or rate limiting - a classic resource exhaustion pattern. CPE data confirms three distinct product families are affected: Oracle Java SE (cpe:2.3:a:oracle_corporation:oracle_java_se), Oracle GraalVM for JDK (cpe:2.3:a:oracle_corporation:oracle_graalvm_for_jdk), and Oracle GraalVM Enterprise Edition (cpe:2.3:a:oracle_corporation:oracle_graalvm_enterprise_edition). The vulnerability manifests both in server-side deployments (Java applications exposing HTTPS APIs) and in client-side deployments running sandboxed Java Web Start applications or applets that load untrusted code from the internet, broadening the attack surface considerably.

RemediationAI

Apply the Oracle April 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpuapr2026.html, which includes patched releases for all affected Java SE and GraalVM versions. Red Hat Enterprise Linux users should apply the corresponding errata: RHSA-2026:9255, RHSA-2026:9256, RHSA-2026:9682, RHSA-2026:9684, RHSA-2026:9685, RHSA-2026:9687, RHSA-2026:9688, RHSA-2026:9689, RHSA-2026:9690, RHSA-2026:9691, RHSA-2026:9693, and RHSA-2026:9694 via the Red Hat Customer Portal at https://access.redhat.com. SUSE users are referenced in the tags as having advisories as well. If immediate patching is not feasible for internet-facing HTTPS services, a compensating control is to place a TLS-terminating reverse proxy or load balancer (such as nginx or HAProxy) in front of the Java application, which can enforce connection rate limits and reject malformed TLS handshakes before they reach the JSSE layer; note this does not remediate the underlying flaw and adds infrastructure complexity. Exact patched version numbers are not independently specified in the advisory data beyond the CPU reference - consult the Oracle CPU document for precise release identifiers.

More in Java

View all
CVE-2012-4681 CRITICAL POC
9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
CVE-2015-7450 CRITICAL POC
9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
CVE-2013-2465 CRITICAL POC
9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2010-1871 HIGH POC
8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
CVE-2012-1723 CRITICAL POC
9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2012-0507 CRITICAL POC
9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
CVE-2015-4852 CRITICAL POC
9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL POC
9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
CVE-2017-3066 CRITICAL POC
9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
CVE-2012-0391 CRITICAL POC
9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-22021 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy