Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade java-26-amazon-corretto-javadocUpgrade java-25-amazon-corretto-debugsymbolsUpgrade java-25-amazon-corretto-headlessUpgrade java-26-amazon-corretto-debugsymbolsUpgrade java-25-amazon-correttoUpgrade java-25-amazon-corretto-develUpgrade java-26-amazon-correttoUpgrade java-26-amazon-corretto-develUpgrade java-26-amazon-corretto-headlessUpgrade java-25-amazon-corretto-javadocUpgrade java-25-amazon-corretto-jmodsUpgrade java-26-amazon-corretto-jmods | Sep 1, 2026 | Aug 18, 2026 |
| Azul Zulu | — | Apply Azul Zulu JDK 26 installer 26.32.203 (JDK 26.0.2.1+1, PSU) (short-term support); migrate to JDK 25 (LTS)Upgrade to Azul Zulu JDK 25 installer 25.35.204 (JDK 25.0.3.0.201+1, quarterly CPU) (LTS stream) | Aug 19, 2026 | Aug 18, 2026 |
| Debian | — | Upgrade openjdk-25 | Aug 26, 2026 | Aug 26, 2026 |
| Eclipseadoptium | — | Upgrade to the latest version of Eclipse Adoptium | Aug 21, 2026 | Aug 18, 2026 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Aug 19, 2026 | Aug 18, 2026 |
| Redhat_linux | — | Upgrade java-25-openjdk-devel-slowdebugUpgrade java-25-openjdk-slowdebugUpgrade java-25-openjdk-develUpgrade java-25-openjdk-static-libs-fastdebugUpgrade java-25-openjdk-crypto-adapter-debuginfoUpgrade java-25-openjdk-crypto-adapter-slowdebugUpgrade java-25-openjdk-demo-slowdebugUpgrade java-25-openjdk-javadoc-zipUpgrade java-25-openjdk-slowdebug-debuginfoUpgrade java-25-openjdk-static-libs-slowdebugUpgrade java-25-openjdk-devel-fastdebug-debuginfoUpgrade java-25-openjdk-crypto-adapter-slowdebug-debuginfoUpgrade java-25-openjdk-devel-debuginfoUpgrade java-25-openjdk-headless-fastdebugUpgrade java-25-openjdk-debugsourceUpgrade java-25-openjdk-demoUpgrade java-25-openjdk-headlessUpgrade java-25-openjdk-javadocUpgrade java-25-openjdk-jmods-slowdebugUpgrade java-25-openjdk-src-fastdebugUpgrade java-25-openjdk-crypto-adapter-fastdebugUpgrade java-25-openjdk-fastdebugUpgrade java-25-openjdk-headless-debuginfoUpgrade java-25-openjdk-headless-slowdebug-debuginfoUpgrade java-25-openjdk-jmods-fastdebugUpgrade java-25-openjdk-static-libsUpgrade java-25-openjdk-devel-slowdebug-debuginfoUpgrade java-25-openjdk-devel-fastdebugUpgrade java-25-openjdkUpgrade java-25-openjdk-fastdebug-debuginfoNo solution existsUpgrade java-25-openjdk-crypto-adapterUpgrade java-25-openjdk-headless-slowdebugUpgrade java-25-openjdk-jmodsUpgrade java-25-openjdk-headless-fastdebug-debuginfoUpgrade java-25-openjdk-srcUpgrade java-25-openjdk-demo-fastdebugUpgrade java-25-openjdk-src-slowdebugUpgrade java-25-openjdk-debuginfoUpgrade java-25-openjdk-crypto-adapter-fastdebug-debuginfo | Aug 21, 2026 | Aug 18, 2026 |
| Rocky_linux | — | Upgrade java-25-openjdk-static-libs-fastdebugUpgrade java-25-openjdk-slowdebugUpgrade java-25-openjdk-devel-fastdebugUpgrade java-25-openjdk-demo-fastdebugUpgrade java-25-openjdk-develUpgrade java-25-openjdk-crypto-adapter-slowdebug-debuginfoUpgrade java-25-openjdk-demo-slowdebugUpgrade java-25-openjdk-headlessUpgrade java-25-openjdk-devel-fastdebug-debuginfoUpgrade java-25-openjdk-crypto-adapter-debuginfoUpgrade java-25-openjdk-devel-slowdebug-debuginfoUpgrade java-25-openjdk-javadocUpgrade java-25-openjdkUpgrade java-25-openjdk-src-fastdebugUpgrade java-25-openjdk-headless-fastdebug-debuginfoUpgrade java-25-openjdk-debuginfoUpgrade java-25-openjdk-crypto-adapter-slowdebugUpgrade java-25-openjdk-devel-debuginfoUpgrade java-25-openjdk-crypto-adapter-fastdebug-debuginfoUpgrade java-25-openjdk-devel-slowdebugUpgrade java-25-openjdk-slowdebug-debuginfoUpgrade java-25-openjdk-crypto-adapter-fastdebugUpgrade java-25-openjdk-fastdebugUpgrade java-25-openjdk-jmods-slowdebugUpgrade java-25-openjdk-headless-slowdebugUpgrade java-25-openjdk-javadoc-zipUpgrade java-25-openjdk-jmodsUpgrade java-25-openjdk-fastdebug-debuginfoUpgrade java-25-openjdk-headless-fastdebugUpgrade java-25-openjdk-crypto-adapterUpgrade java-25-openjdk-debugsourceUpgrade java-25-openjdk-srcUpgrade java-25-openjdk-demoUpgrade java-25-openjdk-src-slowdebugUpgrade java-25-openjdk-jmods-fastdebugUpgrade java-25-openjdk-headless-slowdebug-debuginfoUpgrade java-25-openjdk-static-libsUpgrade java-25-openjdk-headless-debuginfoUpgrade java-25-openjdk-static-libs-slowdebug | Aug 24, 2026 | Aug 21, 2026 |
| Ubuntu | — | Upgrade openjdk-25-jre-zeroUpgrade openjdk-25-jdk-headlessUpgrade openjdk-25-jreUpgrade openjdk-25-jre-headlessUpgrade openjdk-25-jdk | Sep 22, 2026 | Sep 21, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub