Skip to main content

Oracle Java SE CVE-2026-34282

| EUVDEUVD-2026-24362 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-04-21 oracle
Denial Of Service Java Oracle Oracle Java Se Oracle Graalvm Enterprise Edition Oracle Graalvm For Jdk Oracle Corporation
7.5
CVSS 3.1 · Vendor: oracle
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify internet-facing Java service
  2. Delivery
    Craft malicious network/protocol input
  3. Exploit
    Submit to vulnerable Networking API
  4. Execution
    Trigger uncontrolled resource consumption
  5. Impact
    JVM hangs or crashes (complete DoS)

Vulnerability Assessment

Weakness
CWE
CWE-400
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the target application pass attacker-controlled data into the vulnerable Networking-component APIs - Oracle explicitly notes the vector is 'through a web service which supplies data to the APIs,' so an application must expose or forward untrusted input to the affected networking code over one of multiple supported protocols. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication and no user interaction are needed once such an endpoint is reachable. The secondary client-side condition applies only to sandboxed Java Web Start applications or applets that load untrusted code - a deprecated, rarely deployed configuration. The practical limiting factor is reachability: only Java/GraalVM services that actually expose the vulnerable networking APIs to untrusted network input are exploitable, so back-end runtimes with no attacker-facing network surface are not at risk.
Impact

The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - network, low complexity, no privileges or user interaction, but the impact is availability-only. That vector reads as trivially reachable, yet the corroborating exploitation signals all point low: EPSS is 0.04% (12th percentile), CISA SSVC records Exploitation: none with Technical Impact: partial, and no POC is known. The one signal that raises attention is SSVC Automatable: yes, meaning the DoS could be scripted and fired at many targets - but a crash-only outcome with no code execution or data exposure limits its strategic value. Net assessment: a legitimate high-CVSS finding whose real-world urgency is moderate - worth patching in the normal Oracle CPU cycle rather than as an emergency, and higher priority only for internet-facing Java services whose uptime is critical.
Exploit ScenarioDerived

An attacker locates an internet-facing Java service that passes externally supplied data to the vulnerable Networking APIs - for example a web service or REST endpoint - and sends a crafted request (or protocol input) that triggers uncontrolled resource consumption. The JVM hangs or crashes, producing a complete denial of service for that service; because SSVC marks the flaw automatable, the attacker can script the request and repeat it against many hosts. No authentication, credentials, or user interaction are required, but no public exploit code is currently known.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 24, 2026

Denial of service in the Networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows an unauthenticated, network-based attacker to cause a hang or repeatable crash (complete availability loss) of the affected runtime. The flaw is described by Oracle as easily exploitable via multiple protocols against any application that feeds attacker-controlled data to the vulnerable networking APIs (e.g., an exposed web service). There is no public exploit identified at time of analysis; EPSS is very low (0.04%, 12th percentile) and CISA SSVC lists exploitation status as none, so this is a patch-in-cycle availability issue rather than an active threat.

RemediationAI

Apply the vendor patch from the Oracle April 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuapr2026.html), upgrading to the fixed Java SE / GraalVM releases published in that CPU; Patch available per vendor advisory. For OpenJDK-based distributions, apply the corresponding Red Hat errata (RHSA-2026:9254/9255/9256 and RHSA-2026:9686 through 9694) or Ubuntu USN-8334-1 as appropriate to your runtime. Where immediate patching is not possible on internet-facing services, reduce exposure by placing the vulnerable Java networking endpoints behind a reverse proxy or WAF that enforces request-size, rate, and timeout limits, and restrict network reachability of the affected services to trusted clients - accepting that these controls only blunt a resource-exhaustion DoS and do not eliminate it. For client-side risk, avoid loading untrusted code via sandboxed Java Web Start applications or applets, a legacy deployment model that should be decommissioned outright.

Affected VersionsENISA

Oracle Java SE 17.0.18
Oracle GraalVM for JDK 21.0.10
Oracle Java SE 25.0.2
Oracle Java SE 21.0.10
Oracle Java SE 26
Oracle GraalVM for JDK 17.0.18
Oracle Java SE 8u481-perf
Oracle Java SE 11.0.30
Oracle GraalVM Enterprise Edition 21.3.17

Affected Packages

euvd oracle_graalvm_enterprise_edition no fix
euvd oracle_graalvm_for_jdk no fix
euvd oracle_java_se no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The defect lives in the JDK/GraalVM Networking subsystem - the core Java networking stack (java.net / protocol handlers, sockets, and HTTP/URL parsing) shared across virtually all server- and client-side Java workloads. It is classified as CWE-400 (Uncontrolled Resource Consumption), meaning specially crafted network input drives the runtime into unbounded CPU, memory, or thread consumption (or an infinite loop) that exhausts resources and halts the JVM. Because the affected CPE set spans oracle_java_se, oracle_graalvm_for_jdk, and oracle_graalvm_enterprise_edition, the weakness is in shared upstream JDK code rather than a single distribution; the confidentiality and integrity impacts are None, consistent with a pure availability/resource-exhaustion bug.

Know when Oracle Java Se gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Unauthenticated network input to networking APIs with low complexity yields AV:N/AC:L/PR:N/UI:N; impact is availability-only (complete DOS), so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch released
Apr 28, 2026 - 20:30 nvd
Patch available
CVE Published
Apr 21, 2026 - 20:35 nvd
HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Executive ViewAI

Why It Matters

A vulnerability in Oracle Java SE and GraalVM runtime could enable attackers to cause application unavailability through the network, potentially disrupting service delivery across any organization using these widely-deployed platforms. The vulnerability requires no authentication and can be triggered by standard network connections, making it a potential availability risk to exposed systems. Exploitation is currently unlikely (no public exploit identified at time of analysis, 0.04% EPSS), making this a routine patch management priority.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 88% exploitable
Prevalence
Ubiquitous
Oracle Java/JDK runtime underpins a huge fraction of enterprise server and client deployments
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Oracle Java Se

View all
CVE-2026-91403 CRITICAL POC
9.1 Oct 21

Unauthenticated remote attackers can read and tamper with critical data handled by Oracle Java SE through its JSSE (Java
CVE-2026-114820 CRITICAL
9.1 Oct 24

Remote unauthenticated compromise of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition is po
CVE-2026-47057 HIGH
7.5 Jul 21

Denial-of-service in Oracle Java SE 8u491 (and 8u491-perf) and 11.0.31 lets an unauthenticated remote attacker hang or r
CVE-2026-47063 HIGH
7.5 Jul 21

Unauthorized data modification in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition (Libraries component)

CVE-2026-22016 HIGH
7.5 Apr 21

Unauthorized data disclosure in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition arises fro
CVE-2026-47058 HIGH
7.4 Jul 21

Unauthorized data access and modification in the Scripting component of Oracle Java SE 8u491, 8u491-perf, and 11.0.31 al
CVE-2026-60147 MEDIUM
6.5 Jul 21

Oracle Java SE's Security component across versions 8u491 through 26.0.1 - and GraalVM for JDK/Enterprise Edition counte
CVE-2026-22003 MEDIUM
6.0 Apr 21

Integrity and availability compromise in Oracle Java SE's Hotspot component affects versions 8u481 and 8u481-b50, as wel
CVE-2026-46968 MEDIUM
5.9 Jul 21

Integrity compromise via TLS in Oracle Java SE's JSSE component allows an unauthenticated remote attacker to perform una
CVE-2026-47027 MEDIUM
5.3 Jul 21

Partial denial-of-service in Oracle Java SE's Libraries component allows unauthenticated network attackers to disrupt av
CVE-2026-47021 MEDIUM
5.3 Jul 21

Partial denial-of-service exposure in the 2D graphics component of Oracle Java SE and GraalVM platforms allows unauthent
CVE-2026-47013 MEDIUM
5.3 Jul 21

Partial denial-of-service in the JavaFX component of Oracle Java SE 8u491 is remotely exploitable by unauthenticated att

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:9254 ADVISORY https://access.redhat.com/errata/RHSA-2026:9255 ADVISORY https://access.redhat.com/errata/RHSA-2026:9256 ADVISORY https://access.redhat.com/errata/RHSA-2026:9686 ADVISORY https://access.redhat.com/errata/RHSA-2026:9687 ADVISORY https://access.redhat.com/errata/RHSA-2026:9688 ADVISORY https://access.redhat.com/errata/RHSA-2026:9689 ADVISORY https://access.redhat.com/errata/RHSA-2026:9690 ADVISORY https://access.redhat.com/errata/RHSA-2026:9691 ADVISORY https://access.redhat.com/errata/RHSA-2026:9693 ADVISORY https://access.redhat.com/errata/RHSA-2026:9694 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-34282 ADVISORY https://ubuntu.com/security/notices/USN-8331-1 ADVISORY https://ubuntu.com/security/notices/USN-8332-1 ADVISORY https://ubuntu.com/security/notices/USN-8333-1 ADVISORY https://ubuntu.com/security/notices/USN-8334-1 ADVISORY https://vuldb.com/vuln/358632 ADVISORY https://www.oracle.com/security-alerts/cpuapr2026.html REF https://access.redhat.com/errata/RHSA-2026:11403 REF https://access.redhat.com/errata/RHSA-2026:11655 REF https://access.redhat.com/errata/RHSA-2026:11822 REF https://access.redhat.com/errata/RHSA-2026:11829 REF https://access.redhat.com/errata/RHSA-2026:11902 REF https://access.redhat.com/errata/RHSA-2026:22328 REF https://access.redhat.com/security/cve/CVE-2026-34282 REF https://bugzilla.redhat.com/show_bug.cgi?id=2460044 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34282.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy