Skip to main content

Oracle Java SE CVE-2026-47021

| EUVDEUVD-2026-46509 MEDIUM
Uncontrolled Resource Consumption (CWE-400)
2026-07-21 oracle GHSA-qw6j-rcfr-8vrx
Denial Of Service Java Oracle Oracle Java Se Oracle Graalvm Enterprise Edition Oracle Graalvm For Jdk Oracle Corporation
5.3
CVSS 3.1 · Vendor: oracle
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify internet-facing Java service processing external graphics data
  2. Delivery
    Craft malformed image or font payload
  3. Exploit
    Deliver payload via HTTP or other supported protocol
  4. Execution
    2D component processes malformed input
  5. Impact
    Partial denial of service triggered on the Java process

Vulnerability Assessment

Weakness
CWE
CWE-400
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that the target system runs one of the affected Java SE or GraalVM versions and that the 2D component is reachable by externally supplied data - either via a web service that passes untrusted input to Java 2D APIs, or via a sandboxed Java Web Start application or Java applet environment executing untrusted code from the internet. No special non-default configuration is required for the web service vector; any Java application that processes external image, font, or graphical data through the standard 2D APIs is potentially in scope. The sandboxed client-side vector additionally requires that the end user's environment still supports Java Web Start or applets (deprecated and removed in modern Java releases, so this vector is practically limited to Java 8 deployments). Exploitation is limited to partial availability impact only - there is no pathway to code execution, data exfiltration, or integrity compromise based on the CVSS vector. Network access to the Java service is the only prerequisite for the primary server-side vector.
Impact

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L reflects a straightforward network-reachable attack requiring no privileges, no user interaction, and no special conditions - Oracle itself labels it 'easily exploitable'. However, the impact ceiling is strictly partial availability (A:L), with no confidentiality or integrity impact, making this a medium-severity issue in practical terms. No EPSS score was provided, but the combination of low attack complexity and wide product footprint suggests non-trivial exploitation probability. The absence of a KEV listing and no confirmed POC tempers urgency relative to other unauthenticated network vulnerabilities. Real-world priority should be highest for internet-facing Java services that accept and process external graphical or image data through 2D APIs, and lower for purely internal deployments where network access to Java services is restricted. The broad version range - spanning from Java 8 through the development branch 26.0.1 - means the majority of production Java environments worldwide are theoretically in scope.
Exploit ScenarioDerived

An attacker submits a specially crafted image file or font resource to an internet-facing web service (such as an image transcoding, thumbnail generation, or document rendering service) that internally passes the data to Java's 2D APIs. The malformed input triggers abnormal behavior in the 2D component, causing the Java process to partially lose availability - manifesting as service slowdown, thread exhaustion, or component crash. Because no authentication is required and attack complexity is low, this scenario is feasible for automated scanning tools targeting known Java service endpoints.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Partial denial-of-service exposure in the 2D graphics component of Oracle Java SE and GraalVM platforms allows unauthenticated remote attackers to disrupt service availability with no authentication and low attack complexity. Affected releases span a broad range including Java SE 8u491 through 26.0.1, GraalVM for JDK 17.0.19 and 21.0.11, and GraalVM Enterprise Edition 21.3.18 - covering virtually every supported Java SE release as of the July 2026 CPU. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though Oracle characterizes the vulnerability as 'easily exploitable', indicating automated exploitation is plausible.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this and other Java SE vulnerabilities. Oracle does not publicly disclose exact patch version numbers in the advisory itself, but the CPU replaces the listed affected versions with fixed builds - verify the installed build number against Oracle's patch matrix in the advisory. For environments where immediate patching is not feasible, restrict network access to Java services that consume external graphical data via 2D APIs, and enforce input size and format validation at ingress points (e.g., API gateways, load balancers) to limit the surface area for malformed image or font data. Disabling Java Web Start entirely (it was deprecated as of Java 11 and removed in later versions) eliminates one attack vector for client-side deployments. For Java 8 environments still running applets, disabling applet execution in the JRE control panel is a viable workaround with the trade-off of breaking legacy applet-based applications.

Affected VersionsENISA

Oracle Java SE 8u491-perf
Oracle GraalVM for JDK 21.0.11
Oracle Java SE 8u491
Oracle GraalVM Enterprise Edition 21.3.18
Oracle Java SE 17.0.19
Oracle Java SE 26.0.1
Oracle Java SE 21.0.11
Oracle Java SE 25.0.3
Oracle GraalVM for JDK 17.0.19
Oracle Java SE 11.0.31

Affected Packages

euvd oracle_graalvm_enterprise_edition no fix
euvd oracle_graalvm_for_jdk no fix
euvd oracle_java_se no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is Java SE's 2D subsystem, which handles rendering of graphics primitives, image format decoding (JPEG, PNG, GIF, TIFF, BMP), font processing, and related I/O operations. Vulnerabilities in this component typically arise from improper input validation or uncontrolled resource consumption when processing externally supplied graphical data - CWE was not assigned by Oracle for this entry, so the precise root cause class (e.g., CWE-400 Uncontrolled Resource Consumption or CWE-20 Improper Input Validation) is unconfirmed. The vulnerability is reachable through any Java application or web service that passes externally supplied data to 2D APIs, and separately applies to sandboxed Java Web Start applications and Java applets that execute untrusted internet-sourced code. CPE strings confirm the affected surface spans three distinct Oracle product families: oracle_java_se, oracle_graalvm_for_jdk, and oracle_graalvm_enterprise_edition.

Know when Oracle Java Se gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vuln.today AI 5.3 MEDIUM

Network-reachable 2D API with no authentication or user interaction required; impact strictly limited to partial availability, no confidentiality or integrity effect confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.3 MEDIUM

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

DescriptionCVE.org

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Threat Intelligence Overview

EPSS Score
0.3%
Top 79% exploitable
Prevalence
Ubiquitous
Java SE runtime deployed across virtually all enterprise environments globally
Data Quality
6 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact· derived
High

Priority Score

26
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +26
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Oracle Java Se

View all
CVE-2026-91403 CRITICAL POC
9.1 Oct 21

Unauthenticated remote attackers can read and tamper with critical data handled by Oracle Java SE through its JSSE (Java
CVE-2026-114820 CRITICAL
9.1 Oct 24

Remote unauthenticated compromise of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition is po
CVE-2026-47057 HIGH
7.5 Jul 21

Denial-of-service in Oracle Java SE 8u491 (and 8u491-perf) and 11.0.31 lets an unauthenticated remote attacker hang or r
CVE-2026-47063 HIGH
7.5 Jul 21

Unauthorized data modification in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition (Libraries component)

CVE-2026-34282 HIGH
7.5 Apr 21

Denial of service in the Networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise E
CVE-2026-22016 HIGH
7.5 Apr 21

Unauthorized data disclosure in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition arises fro
CVE-2026-47058 HIGH
7.4 Jul 21

Unauthorized data access and modification in the Scripting component of Oracle Java SE 8u491, 8u491-perf, and 11.0.31 al
CVE-2026-60147 MEDIUM
6.5 Jul 21

Oracle Java SE's Security component across versions 8u491 through 26.0.1 - and GraalVM for JDK/Enterprise Edition counte
CVE-2026-22003 MEDIUM
6.0 Apr 21

Integrity and availability compromise in Oracle Java SE's Hotspot component affects versions 8u481 and 8u481-b50, as wel
CVE-2026-46968 MEDIUM
5.9 Jul 21

Integrity compromise via TLS in Oracle Java SE's JSSE component allows an unauthenticated remote attacker to perform una
CVE-2026-47027 MEDIUM
5.3 Jul 21

Partial denial-of-service in Oracle Java SE's Libraries component allows unauthenticated network attackers to disrupt av
CVE-2026-47013 MEDIUM
5.3 Jul 21

Partial denial-of-service in the JavaFX component of Oracle Java SE 8u491 is remotely exploitable by unauthenticated att

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:42876 ADVISORY https://access.redhat.com/errata/RHSA-2026:42877 ADVISORY https://access.redhat.com/errata/RHSA-2026:42878 ADVISORY https://access.redhat.com/errata/RHSA-2026:42879 ADVISORY https://access.redhat.com/errata/RHSA-2026:42880 ADVISORY https://access.redhat.com/errata/RHSA-2026:42881 ADVISORY https://access.redhat.com/errata/RHSA-2026:42882 ADVISORY https://access.redhat.com/errata/RHSA-2026:42887 ADVISORY https://access.redhat.com/errata/RHSA-2026:42889 ADVISORY https://access.redhat.com/errata/RHSA-2026:42893 ADVISORY https://access.redhat.com/errata/RHSA-2026:42895 ADVISORY https://access.redhat.com/errata/RHSA-2026:42897 ADVISORY https://access.redhat.com/errata/RHSA-2026:42898 ADVISORY https://access.redhat.com/errata/RHSA-2026:42900 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-47021 ADVISORY https://ubuntu.com/security/notices/USN-8681-1 ADVISORY https://vuldb.com/vuln/381118 ADVISORY https://www.oracle.com/security-alerts/cpujul2026.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy