Skip to main content

Oracle Java SE CVE-2026-22021

| EUVDEUVD-2026-24335 MEDIUM
Uncontrolled Resource Consumption (CWE-400)
2026-04-21 oracle
Denial Of Service Java Oracle Oracle Java Se Oracle Graalvm Enterprise Edition Oracle Graalvm For Jdk Oracle Corporation
5.3
CVSS 3.1 · Vendor: oracle
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send crafted HTTPS request to Java JSSE endpoint
  2. Exploit
    Trigger uncontrolled resource consumption in TLS processing
  3. Execution
    Exhaust server resources
  4. Impact
    Cause partial denial of service

Vulnerability Assessment

Weakness
CWE
CWE-400
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires network access to a target system running one of the affected Java SE or GraalVM versions over HTTPS. No authentication is required (CVSS PR:N). Two distinct exploitation paths exist: first, server-side exploitation via any web service or API that processes incoming HTTPS connections using the JSSE component - this is the primary path for network-exposed Java applications; second, client-side exploitation targeting sandboxed Java Web Start applications or Java applets that load and execute untrusted code from the internet while relying on the Java sandbox. The description explicitly states the vulnerability is exploitable 'by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs.' No special non-default configuration is required beyond having a Java application accept HTTPS connections. Exploitation is limited to partial availability impact only - confidentiality and integrity are unaffected, and scope does not change (S:U), meaning the attacker cannot pivot to the underlying host OS through this flaw.
Impact

The overall real-world risk is moderate-low despite the broad product footprint. CVSS 3.1 base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L accurately reflects that the attack is trivially automatable from the network but impact is limited to partial availability degradation with no confidentiality or integrity consequences. The EPSS score of 0.04% at the 12th percentile is notably low, indicating the security community assesses mass exploitation as unlikely in the near term. SSVC corroborates this: Exploitation is rated 'none' and Technical Impact 'partial', though Automatable is 'yes', meaning a threat actor could mechanically probe many targets. No KEV listing and no confirmed public exploit code further reduce urgency. The key tension is between the extremely wide deployment footprint of Java SE (ubiquitous across enterprise environments) and the limited impact - partial DoS only. Security teams should prioritize patching in environments where Java services are internet-exposed or where availability SLAs are critical, but this does not require emergency response outside standard patch cycles.
Exploit ScenarioDerived

An unauthenticated attacker on the internet sends a high volume of specially crafted HTTPS requests or malformed TLS handshakes to a Java web service using the JSSE component, triggering unbounded resource allocation in the SSL/TLS processing path. The server progressively exhausts available memory or connection pool capacity, resulting in degraded response times or connection refusals for legitimate users. No exploit code is publicly confirmed, but the low attack complexity (AV:N/AC:L) and automatable nature (SSVC) mean this scenario could be executed with basic tooling.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 24, 2026

Uncontrolled resource consumption in Oracle Java SE's JSSE (Java Secure Socket Extension) component allows unauthenticated remote attackers to cause partial denial of service against HTTPS-enabled Java services and GraalVM deployments. Affected versions span all major Java SE release trains from 8u481 through 26, as well as GraalVM for JDK and GraalVM Enterprise Edition. Oracle confirmed the vulnerability in the April 2026 Critical Patch Update; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

RemediationAI

Apply the Oracle April 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpuapr2026.html, which includes patched releases for all affected Java SE and GraalVM versions. Red Hat Enterprise Linux users should apply the corresponding errata: RHSA-2026:9255, RHSA-2026:9256, RHSA-2026:9682, RHSA-2026:9684, RHSA-2026:9685, RHSA-2026:9687, RHSA-2026:9688, RHSA-2026:9689, RHSA-2026:9690, RHSA-2026:9691, RHSA-2026:9693, and RHSA-2026:9694 via the Red Hat Customer Portal at https://access.redhat.com. SUSE users are referenced in the tags as having advisories as well. If immediate patching is not feasible for internet-facing HTTPS services, a compensating control is to place a TLS-terminating reverse proxy or load balancer (such as nginx or HAProxy) in front of the Java application, which can enforce connection rate limits and reject malformed TLS handshakes before they reach the JSSE layer; note this does not remediate the underlying flaw and adds infrastructure complexity. Exact patched version numbers are not independently specified in the advisory data beyond the CPU reference - consult the Oracle CPU document for precise release identifiers.

Affected VersionsENISA

Oracle Java SE 8u481
Oracle Java SE 8u481-perf
Oracle Java SE 17.0.18
Oracle Java SE 11.0.30
Oracle Java SE 25.0.2
Oracle Java SE 8u481-b50
Oracle Java SE 21.0.10
Oracle GraalVM for JDK 21.0.10
Oracle GraalVM Enterprise Edition 21.3.17
Oracle GraalVM for JDK 17.0.18
Oracle Java SE 26

Affected Packages

euvd oracle_graalvm_enterprise_edition no fix
euvd oracle_graalvm_for_jdk no fix
euvd oracle_java_se no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

JSSE is Oracle's implementation of the SSL and TLS protocols within the Java platform, responsible for handling secure HTTPS connections at the socket layer. CWE-400 (Uncontrolled Resource Consumption) indicates that maliciously crafted TLS/HTTPS input can cause the JSSE component to consume disproportionate memory, CPU, or connection slots without adequate bounds checking or rate limiting - a classic resource exhaustion pattern. CPE data confirms three distinct product families are affected: Oracle Java SE (cpe:2.3:a:oracle_corporation:oracle_java_se), Oracle GraalVM for JDK (cpe:2.3:a:oracle_corporation:oracle_graalvm_for_jdk), and Oracle GraalVM Enterprise Edition (cpe:2.3:a:oracle_corporation:oracle_graalvm_enterprise_edition). The vulnerability manifests both in server-side deployments (Java applications exposing HTTPS APIs) and in client-side deployments running sandboxed Java Web Start applications or applets that load untrusted code from the internet, broadening the attack surface considerably.

Know when Oracle Java Se gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vuln.today AI 5.3 MEDIUM

Network-reachable HTTPS endpoint with no auth required; only partial availability impact and no confidentiality or integrity effects, matching description exactly.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.3 MEDIUM

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

2
Patch released
Apr 28, 2026 - 08:30 nvd
Patch available
CVE Published
Apr 21, 2026 - 20:35 nvd
MEDIUM 5.3

DescriptionCVE.org

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Threat Intelligence Overview

EPSS Score
0.0%
Top 88% exploitable
Prevalence
Ubiquitous
Java SE runtime deployed across virtually all enterprise and server environments globally
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact· derived
High
Technical Impact
Partial

Priority Score

26
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +26
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Oracle Java Se

View all
CVE-2026-91403 CRITICAL POC
9.1 Oct 21

Unauthenticated remote attackers can read and tamper with critical data handled by Oracle Java SE through its JSSE (Java
CVE-2026-114820 CRITICAL
9.1 Oct 24

Remote unauthenticated compromise of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition is po
CVE-2026-47057 HIGH
7.5 Jul 21

Denial-of-service in Oracle Java SE 8u491 (and 8u491-perf) and 11.0.31 lets an unauthenticated remote attacker hang or r
CVE-2026-47063 HIGH
7.5 Jul 21

Unauthorized data modification in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition (Libraries component)

CVE-2026-34282 HIGH
7.5 Apr 21

Denial of service in the Networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise E
CVE-2026-22016 HIGH
7.5 Apr 21

Unauthorized data disclosure in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition arises fro
CVE-2026-47058 HIGH
7.4 Jul 21

Unauthorized data access and modification in the Scripting component of Oracle Java SE 8u491, 8u491-perf, and 11.0.31 al
CVE-2026-60147 MEDIUM
6.5 Jul 21

Oracle Java SE's Security component across versions 8u491 through 26.0.1 - and GraalVM for JDK/Enterprise Edition counte
CVE-2026-22003 MEDIUM
6.0 Apr 21

Integrity and availability compromise in Oracle Java SE's Hotspot component affects versions 8u481 and 8u481-b50, as wel
CVE-2026-46968 MEDIUM
5.9 Jul 21

Integrity compromise via TLS in Oracle Java SE's JSSE component allows an unauthenticated remote attacker to perform una
CVE-2026-47027 MEDIUM
5.3 Jul 21

Partial denial-of-service in Oracle Java SE's Libraries component allows unauthenticated network attackers to disrupt av
CVE-2026-47021 MEDIUM
5.3 Jul 21

Partial denial-of-service exposure in the 2D graphics component of Oracle Java SE and GraalVM platforms allows unauthent

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:9254 ADVISORY https://access.redhat.com/errata/RHSA-2026:9255 ADVISORY https://access.redhat.com/errata/RHSA-2026:9256 ADVISORY https://access.redhat.com/errata/RHSA-2026:9682 ADVISORY https://access.redhat.com/errata/RHSA-2026:9683 ADVISORY https://access.redhat.com/errata/RHSA-2026:9684 ADVISORY https://access.redhat.com/errata/RHSA-2026:9685 ADVISORY https://access.redhat.com/errata/RHSA-2026:9686 ADVISORY https://access.redhat.com/errata/RHSA-2026:9687 ADVISORY https://access.redhat.com/errata/RHSA-2026:9688 ADVISORY https://access.redhat.com/errata/RHSA-2026:9689 ADVISORY https://access.redhat.com/errata/RHSA-2026:9690 ADVISORY https://access.redhat.com/errata/RHSA-2026:9691 ADVISORY https://access.redhat.com/errata/RHSA-2026:9693 ADVISORY https://access.redhat.com/errata/RHSA-2026:9694 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-22021 ADVISORY https://ubuntu.com/security/notices/USN-8330-1 ADVISORY https://ubuntu.com/security/notices/USN-8331-1 ADVISORY https://ubuntu.com/security/notices/USN-8332-1 ADVISORY https://ubuntu.com/security/notices/USN-8333-1 ADVISORY https://ubuntu.com/security/notices/USN-8334-1 ADVISORY https://vuldb.com/vuln/358628 ADVISORY https://www.oracle.com/security-alerts/cpuapr2026.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy