What is the CVSS score of CVE-2026-47057?

CVE-2026-47057 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Java SE are affected by CVE-2026-47057?

Oracle Java SE versions 8u491 and 11.0.31 contain a network-accessible denial-of-service vulnerability in the Scripting API that allows unauthenticated remote attackers to crash or hang the JVM with…. A patch is available.

How to fix or mitigate CVE-2026-47057?

Within 24 hours, complete a complete inventory of all systems running Oracle Java SE 8u491 or 11.0.31-particularly production web services, API endpoints, and Scripting API consumers-and document network exposure (internet-facing, internal network, or isolated). Within 7 days, implement network-level rate limiting on affected Java services, add input validation to reject malformed Scripting API calls, and isolate non-critical Java instances from untrusted networks where operationally feasible; enable comprehensive logging of connection attempts and Java crash events. Within 30 days, execute an upgrade plan to Oracle Java SE 8u501 or 11.0.32 when available from Oracle, or deploy a Web Application Firewall (WAF) with rules to detect and drop malicious Scripting API payloads; prioritize migrations of services handling customer-facing or revenue-critical workloads.

Oracle Java SE CVE-2026-47057

EUVD-2026-46543 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-qfmm-wrmh-r6pr

Denial Of Service Java Oracle Oracle Java Se Oracle Corporation

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable input to the Scripting APIs with low complexity and no user interaction, causing complete availability loss only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:14 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Articles & Coverage 1

News 6 New Java Vulnerabilities - 1 Critical, 5 High Severity Jul 22, 2026

AnalysisAI

Denial-of-service in Oracle Java SE 8u491 (and 8u491-perf) and 11.0.31 lets an unauthenticated remote attacker hang or repeatedly crash the JVM by feeding crafted input to the Scripting component's APIs, for example via a web service that passes data to those APIs. There is no confidentiality or integrity impact - only availability - but the attack is network-reachable, low-complexity, and requires no authentication or user interaction, yielding a CVSS 7.5. No public exploit identified at time of analysis and the flaw is not on CISA KEV.

Technical ContextAI

The affected component is the Scripting subsystem of Oracle Java SE, which historically corresponds to the JSR-223 scripting framework (javax.script / the Nashorn engine in these versions) that lets Java applications evaluate script code and script-supplied data at runtime. The vulnerability manifests when untrusted data reaches these Scripting APIs and drives the JVM into an unrecoverable hang or crash, i.e. an availability failure rather than code execution or data disclosure. No CWE was assigned in the source data, but the observed behavior (complete DOS from parsed/evaluated input) is consistent with the uncontrolled-resource-consumption / infinite-loop class of defects. The single CPE provided, cpe:2.3:a:oracle_corporation:oracle_java_se:*:*:*:*:*:*:*:*, is wildcarded and does not itself pin the versions; the affected releases come from the Oracle description text (8u491, 8u491-perf, 11.0.31).

RemediationAI

Apply the fixed Oracle Java SE builds delivered in the July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); the input data does not enumerate an exact fixed build number, so treat this as patch available per vendor advisory and pull the specific patched 8u and 11.0.x release listed in that CPU rather than an invented version. Where immediate patching is not possible, the most effective compensating control is to stop untrusted data from reaching the Scripting component - disable or remove use of the Nashorn/JSR-223 scripting engine in applications that do not require it, or validate and constrain any external input before it is passed to javax.script APIs (trade-off: breaks legitimate scripting features that depend on it). For the client scenario, avoid running sandboxed Java Web Start applications or applets that load untrusted code (trade-off: these deployment modes are already deprecated and generally safe to disable). Network-level rate limiting or restricting access to the exposed web service that feeds the Scripting APIs can reduce, but not eliminate, the DoS exposure.

More in Java

View all

CVE-2012-4681 CRITICAL Emergency POC

9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m

CVE-2015-7450 CRITICAL Emergency POC

9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti

CVE-2013-2465 CRITICAL Act Now POC

9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent

CVE-2011-3544 CRITICAL Act Now POC

9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug

CVE-2010-1871 HIGH Act Now POC

8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to

CVE-2012-1723 CRITICAL Emergency POC

9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up

CVE-2013-0422 CRITICAL Emergency POC

9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using

CVE-2012-0507 CRITICAL Emergency POC

9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up

CVE-2015-4852 CRITICAL Act Now POC

9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL Act Now POC

9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow

CVE-2017-3066 CRITICAL Act Now POC

9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla

CVE-2012-0391 CRITICAL Act Now POC

9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all

CVE-2023-44487 HIGH POC

7.5

CVE-2026-45498 HIGH POC

7.5

CVE-2016-8610 HIGH

7.5

CVE-2026-28318 HIGH POC

7.5

7.5

7.5

7.5

7.5

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected

CVE-2026-47057 vulnerability details – vuln.today

Back

Oracle Java SE CVE-2026-47057

Severity by source

CVSS VectorVendor: oracle

Lifecycle Timeline

DescriptionCVE.org

Articles & Coverage 1

AnalysisAI

Technical ContextAI

RemediationAI

More in Java

Same weakness CWE-400 – Uncontrolled Resource Consumption

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code