Oracle Java SE CVE-2026-91410

Exploitation requires that an application expose the vulnerable Oracle Java SE Libraries API to attacker-controlled data - in practice a network-reachable service (e.g., a web service) that passes untrusted input into the affected component. Per the Oracle description it also applies to sandboxed Java Web Start applications and sandboxed applets that load untrusted code and rely on the Java sandbox. Limiting factors: impact is confined to a PARTIAL denial of service (A:L) with no confidentiality or integrity effect and no code execution; exploitability depends on an application actually routing untrusted input to the affected API, and the sandboxed-applet/Web Start vector is largely legacy and disabled in most modern browser/deployment environments. CVSS PR:N/UI:N/AC:L indicate no authentication, no user interaction, and low complexity once such a data path exists.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score is 5.3 (MEDIUM) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - meaning network-reachable, low-complexity, unauthenticated, no user interaction, but with impact strictly limited to a PARTIAL availability loss (A:L) and zero confidentiality or integrity impact. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so there is no evidence of active or imminent exploitation; the signals are therefore consistent with each other (a low-impact DoS that is easy to trigger but not catastrophic). The main real-world amplifier is NOT severity but exposure: this is Oracle Java SE, a near-ubiquitous runtime, so a widely-reachable, unauthenticated, low-complexity DoS deserves patching within the normal Oracle CPU cycle even though it cannot lead to code execution or data compromise. Note the signals to treat with caution: EPSS is absent (not low - simply not provided), so exploitation probability cannot be quantified from this data, and the CWE is listed as N/A, so the precise defect class (likely a resource-exhaustion/uncontrolled-consumption bug in a Libraries API) is inferred, not confirmed.

An unauthenticated attacker sends specially crafted data to a network-facing service that feeds untrusted input into the vulnerable Oracle Java SE Libraries API (for example, a web service or parser endpoint). Processing the malicious input causes excessive resource consumption or an unhandled condition, degrading or interrupting availability of that Java component (partial DoS). No public exploit code was identified in the provided data, and the attack yields no data disclosure or code execution.