Skip to main content

Oracle Java SE CVE-2026-46917

| EUVDEUVD-2026-46459 MEDIUM
Improper Access Control (CWE-284)
2026-07-21 oracle GHSA-x5x7-pvpw-w5hv
Authentication Bypass Denial Of Service Java Oracle Oracle Java Se Oracle Graalvm Enterprise Edition Oracle Graalvm For Jdk Oracle Corporation
5.3
CVSS 3.1 · Vendor: oracle
Share

Severity by source

Vendor (oracle) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vuln.today AI
5.3 MEDIUM

Network-accessible TLS service, no authentication or privileges required; impact is strictly partial availability with confirmed zero confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Jul 22, 2026 - 01:59 vuln.today
CVE Published
Jul 21, 2026 - 21:32 nvd
MEDIUM 5.3

DescriptionCVE.org

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

AnalysisAI

Partial denial-of-service exposure in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated remote attackers to degrade service availability by supplying malformed data via TLS. Affected releases span five Oracle Java SE versions (11.0.31 through 26.0.1) and both GraalVM product lines, as disclosed in Oracle's CPU July 2026 advisory (EUVD-2026-46459). No public exploit identified at time of analysis and no CISA KEV listing; the CVSS 5.3 rating reflects a genuine but bounded availability impact rather than a critical or confidentiality-affecting risk.

Technical ContextAI

JSSE (Java Secure Socket Extension) is Oracle's built-in TLS/SSL implementation within the Java platform, providing the javax.net.ssl API surface used by virtually all Java server-side applications for encrypted network communication. The vulnerability lies in how the JSSE component processes TLS protocol data supplied by external callers - specifically through server-facing APIs rather than browser plugin vectors such as Java Web Start or applets. No CWE has been assigned by Oracle, so the precise root cause class is unconfirmed; common JSSE DoS patterns involve anomalous handshake state machine transitions, unbounded resource allocation during certificate or extension processing, or processing loops triggered by malformed TLS records. CPE identifiers confirm three distinct product lines are affected: oracle_corporation:oracle_java_se, oracle_corporation:oracle_graalvm_for_jdk, and oracle_corporation:oracle_graalvm_enterprise_edition, spanning both standard and enterprise GraalVM distributions.

RemediationAI

Apply the Oracle Critical Patch Update released in July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability across all three affected product lines. Exact patched version numbers are not independently confirmed in the available data beyond the CPU advisory itself - consult the advisory's patch matrix for the specific fix versions applicable to each Java SE and GraalVM release train. As an interim compensating control where immediate patching is not possible, place a hardened TLS-terminating reverse proxy (such as nginx or HAProxy) in front of Java application endpoints to absorb malformed TLS traffic before it reaches the vulnerable JSSE layer; note this adds latency and an additional infrastructure component to maintain. Restricting network access to TLS endpoints to known-trusted IP ranges reduces the attacker pool but does not eliminate the vulnerability for services that must accept public connections.

More in Java

View all
CVE-2012-4681 CRITICAL POC
9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
CVE-2015-7450 CRITICAL POC
9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
CVE-2013-2465 CRITICAL POC
9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2010-1871 HIGH POC
8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
CVE-2012-1723 CRITICAL POC
9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2012-0507 CRITICAL POC
9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
CVE-2015-4852 CRITICAL POC
9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL POC
9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
CVE-2017-3066 CRITICAL POC
9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
CVE-2012-0391 CRITICAL POC
9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected

Share

CVE-2026-46917 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy