What is the CVSS score of EUVD-2026-24332?

EUVD-2026-24332 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-24332?

Yes, a patch is available for EUVD-2026-24332. Update the affected software to the latest version immediately.

Oracle Java SE EUVD-2026-24332

| CVE-2026-22018 LOW

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-04-21 oracle

Denial Of Service Java Oracle Oracle Java Se Oracle Graalvm Enterprise Edition Oracle Graalvm For Jdk Oracle Corporation

3.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

3.7 LOW

Network-reachable via web service APIs or untrusted client code; high complexity limits reliable triggering; availability-only partial impact; unauthenticated access consistent with PR:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:32 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24332

CVE Published

Apr 21, 2026 - 20:35 nvd

LOW 3.7

DescriptionCVE.org

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

AnalysisAI

Partial denial-of-service exposure in the Libraries component of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition allows unauthenticated remote attackers to degrade service availability across a wide range of versions from Java 8u481 through 26. The flaw (CWE-770) can be triggered via APIs exposed by web services consuming attacker-controlled input, or through client-side Java Web Start and applet environments loading untrusted code. No active exploitation has been observed (not in CISA KEV), no public proof-of-concept has been identified, and both EPSS (0.04%, 12th percentile) and SSVC (Exploitation: none, Automatable: no) classify this as low operational urgency.

Technical ContextAI

The vulnerability resides in the Libraries component of Oracle's JDK and GraalVM product lines, covering CPE strings cpe:2.3:a:oracle_corporation:oracle_java_se, oracle_graalvm_for_jdk, and oracle_graalvm_enterprise_edition. CWE-770 (Allocation of Resources Without Limits or Throttling) identifies the root cause as a failure to enforce bounds on resource consumption - memory, threads, or similar JVM resources - when processing crafted input via Libraries APIs. The multi-protocol attack surface (AV:N) reflects that the Java Libraries component exposes functionality over diverse protocols including HTTP, RMI, JNDI, and others used by Java web services. The vulnerability also extends to client-side Java deployments: sandboxed Java Web Start applications and Java applets that load and execute untrusted code from the internet, relying on the sandbox to prevent escalation, can serve as an alternative trigger path.

RemediationAI

Apply the Oracle April 2026 Critical Patch Update (CPU) available at https://www.oracle.com/security-alerts/cpuapr2026.html, which constitutes the vendor-released fix for all affected Oracle Java SE and GraalVM product lines. Ubuntu users running OpenJDK packages should apply the updates referenced in USN-8330-1 through USN-8334-1 (https://ubuntu.com/security/notices/USN-8330-1 through USN-8334-1) for their respective distributions. Specific fixed version numbers beyond the CPU release are not independently confirmed in available references; the CPU itself is the authoritative remediation boundary. As a compensating control where patching is delayed, restrict inbound network access to Java-based services at the perimeter to reduce exposure - this does not eliminate the vulnerability but narrows the viable attack surface. For environments running client-side Java Web Start or applet deployments that load untrusted code, disabling those deployment modes eliminates that attack path entirely, with the trade-off of losing associated application functionality.