Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVSS Details
- CVSS 3.1 Base Score: 3.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Adoptopenjdk | — | — | Feb 24, 2026 | Feb 24, 2026 |
| Alma_linux | — | Upgrade java-21-openjdk-jmods-slowdebugUpgrade java-21-openjdk-srcUpgrade java-21-openjdk-static-libs-slowdebugUpgrade java-21-openjdk-headlessUpgrade java-21-openjdk-headless-slowdebugUpgrade java-21-openjdk-javadoc-zipUpgrade java-21-openjdk-src-slowdebugUpgrade java-21-openjdk-develUpgrade java-21-openjdkUpgrade java-21-openjdk-devel-slowdebugUpgrade java-21-openjdk-devel-fastdebugUpgrade java-21-openjdk-demoUpgrade java-21-openjdk-jmods-fastdebugUpgrade java-21-openjdk-demo-fastdebugUpgrade java-21-openjdk-demo-slowdebugUpgrade java-21-openjdk-static-libs-fastdebugUpgrade java-21-openjdk-jmodsUpgrade java-21-openjdk-static-libsUpgrade java-21-openjdk-javadocUpgrade java-21-openjdk-slowdebugUpgrade java-21-openjdk-src-fastdebugUpgrade java-21-openjdk-headless-fastdebugUpgrade java-21-openjdk-fastdebug | Nov 4, 2025 | Oct 22, 2025 |
| Alpine Linux | — | Upgrade openjdk21Upgrade openjdk25 | Nov 10, 2025 | Oct 21, 2025 |
| Amazon_linux_2023 | — | Upgrade java-21-amazon-corretto-debugsymbolsUpgrade java-25-amazon-corretto-headlessUpgrade java-21-amazon-corretto-develUpgrade java-21-amazon-correttoUpgrade java-25-amazon-corretto-jmodsUpgrade java-25-amazon-correttoUpgrade java-25-amazon-corretto-debugsymbolsUpgrade java-21-amazon-corretto-javadocUpgrade java-21-amazon-corretto-jmodsUpgrade java-21-amazon-corretto-headlessUpgrade java-25-amazon-corretto-javadocUpgrade java-25-amazon-corretto-devel | Oct 28, 2025 | Oct 21, 2025 |
| Azul Zulu | — | Upgrade to Azul Zulu JDK 21 installer 21.45.14 (JDK 21.0.8.0.101+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 25 installer 25.29.12 (JDK 25.0.0.0.101+1, quarterly CPU) (LTS stream) | Feb 25, 2026 | Oct 21, 2025 |
| Debian | — | Upgrade openjdk-21Upgrade openjdk-25 | Jul 23, 2026 | Jul 23, 2026 |
| Eclipseadoptium | — | Upgrade to the latest version of Eclipse Adoptium | Jun 26, 2026 | Oct 21, 2025 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Oct 24, 2025 | Oct 21, 2025 |
| Oracle_linux | — | Upgrade java-21-openjdk-fastdebugUpgrade java-21-openjdk-src-slowdebugUpgrade java-25-openjdk-jmods-fastdebugUpgrade java-25-openjdk-devel-fastdebugUpgrade java-21-openjdk-devel-fastdebugUpgrade java-25-openjdk-fastdebugUpgrade java-21-openjdk-srcUpgrade java-21-openjdk-headless-slowdebugUpgrade java-25-openjdk-srcUpgrade java-21-openjdk-jmods-fastdebugUpgrade java-21-openjdk-slowdebugUpgrade java-21-openjdk-headless-fastdebugUpgrade java-25-openjdk-static-libsUpgrade java-25-openjdk-headless-slowdebugUpgrade java-25-openjdk-src-fastdebugUpgrade java-25-openjdk-jmodsUpgrade java-21-openjdk-jmodsUpgrade java-25-openjdk-demo-fastdebugUpgrade java-21-openjdk-javadoc-zipUpgrade java-21-openjdk-demo-fastdebugUpgrade java-25-openjdk-javadocUpgrade java-21-openjdk-static-libsUpgrade java-25-openjdk-static-libs-fastdebugUpgrade java-21-openjdk-javadocUpgrade java-21-openjdk-develUpgrade java-25-openjdk-demoUpgrade java-21-openjdk-demo-slowdebugUpgrade java-21-openjdk-jmods-slowdebugUpgrade java-25-openjdk-devel-slowdebugUpgrade java-21-openjdkUpgrade java-21-openjdk-devel-slowdebugUpgrade java-21-openjdk-headlessUpgrade java-25-openjdk-headless-fastdebugUpgrade java-25-openjdk-demo-slowdebugUpgrade java-25-openjdkUpgrade java-25-openjdk-javadoc-zipUpgrade java-21-openjdk-src-fastdebugUpgrade java-21-openjdk-static-libs-slowdebugUpgrade java-21-openjdk-static-libs-fastdebugUpgrade java-25-openjdk-jmods-slowdebugUpgrade java-25-openjdk-src-slowdebugUpgrade java-25-openjdk-slowdebugUpgrade java-21-openjdk-demoUpgrade java-25-openjdk-static-libs-slowdebugUpgrade java-25-openjdk-headlessUpgrade java-25-openjdk-devel | Oct 27, 2025 | Oct 21, 2025 |
| Redhat_linux | — | Upgrade java-21-openjdk-demo-slowdebugUpgrade java-25-openjdk-src-fastdebugUpgrade java-25-openjdk-demo-slowdebugUpgrade java-21-openjdk-devel-slowdebugUpgrade java-25-openjdk-src-slowdebugUpgrade java-25-openjdk-javadoc-zipUpgrade java-21-openjdk-jmods-slowdebugUpgrade java-25-openjdk-static-libs-fastdebugUpgrade java-25-openjdkUpgrade java-21-openjdk-devel-fastdebug-debuginfoUpgrade java-25-openjdk-demoUpgrade java-25-openjdk-develUpgrade java-21-openjdk-javadoc-zipUpgrade java-21-openjdk-devel-debuginfoUpgrade java-25-openjdk-devel-fastdebug-debuginfoUpgrade java-21-openjdk-static-libs-slowdebugUpgrade java-25-openjdk-headlessUpgrade java-21-openjdk-javadocUpgrade java-21-openjdk-jmodsUpgrade java-25-openjdk-devel-slowdebug-debuginfoUpgrade java-21-openjdk-static-libs-fastdebugUpgrade java-25-openjdk-headless-fastdebugUpgrade java-25-openjdk-debugsourceUpgrade java-21-openjdk-demo-fastdebugUpgrade java-21-openjdk-src-fastdebugUpgrade java-21-openjdk-develUpgrade java-21-openjdk-demoUpgrade java-21-openjdk-headlessUpgrade java-25-openjdk-jmods-slowdebugUpgrade java-25-openjdk-fastdebugUpgrade java-25-openjdk-slowdebugUpgrade java-25-openjdk-devel-slowdebugUpgrade java-21-openjdkUpgrade java-25-openjdk-static-libs-slowdebugUpgrade java-21-openjdk-headless-fastdebug-debuginfoUpgrade java-25-openjdk-headless-debuginfoUpgrade java-25-openjdk-devel-debuginfoUpgrade java-21-openjdk-jmods-fastdebugUpgrade java-21-openjdk-srcUpgrade java-25-openjdk-slowdebug-debuginfoUpgrade java-21-openjdk-slowdebug-debuginfoUpgrade java-21-openjdk-headless-fastdebugUpgrade java-21-openjdk-slowdebugUpgrade java-25-openjdk-headless-slowdebug-debuginfoUpgrade java-25-openjdk-srcUpgrade java-21-openjdk-headless-slowdebug-debuginfoUpgrade java-25-openjdk-jmodsUpgrade java-21-openjdk-devel-fastdebugUpgrade java-21-openjdk-headless-slowdebugUpgrade java-21-openjdk-src-slowdebugUpgrade java-25-openjdk-devel-fastdebugUpgrade java-21-openjdk-devel-slowdebug-debuginfoUpgrade java-25-openjdk-headless-slowdebugUpgrade java-21-openjdk-static-libsUpgrade java-25-openjdk-debuginfoUpgrade java-25-openjdk-javadocUpgrade java-25-openjdk-jmods-fastdebugUpgrade java-21-openjdk-headless-debuginfoUpgrade java-25-openjdk-static-libsUpgrade java-25-openjdk-fastdebug-debuginfoUpgrade java-25-openjdk-demo-fastdebugUpgrade java-21-openjdk-fastdebugUpgrade java-21-openjdk-fastdebug-debuginfoUpgrade java-21-openjdk-debuginfoUpgrade java-25-openjdk-headless-fastdebug-debuginfoUpgrade java-21-openjdk-debugsource | Oct 24, 2025 | Oct 21, 2025 |
| Rocky_linux | — | Upgrade java-25-openjdkUpgrade java-25-openjdk-src-slowdebugUpgrade java-25-openjdk-static-libs-fastdebugUpgrade java-25-openjdk-fastdebug-debuginfoUpgrade java-25-openjdk-devel-slowdebugUpgrade java-25-openjdk-headless-debuginfoUpgrade java-25-openjdk-static-libsUpgrade java-25-openjdk-static-libs-slowdebugUpgrade java-25-openjdk-headless-fastdebugUpgrade java-25-openjdk-demoUpgrade java-25-openjdk-develUpgrade java-25-openjdk-jmods-fastdebugUpgrade java-25-openjdk-slowdebugUpgrade java-25-openjdk-debuginfoUpgrade java-25-openjdk-jmods-slowdebugUpgrade java-25-openjdk-demo-slowdebugUpgrade java-25-openjdk-javadocUpgrade java-25-openjdk-devel-fastdebugUpgrade java-25-openjdk-demo-fastdebugUpgrade java-25-openjdk-headless-fastdebug-debuginfoUpgrade java-25-openjdk-devel-fastdebug-debuginfoUpgrade java-25-openjdk-headlessUpgrade java-25-openjdk-javadoc-zipUpgrade java-25-openjdk-debugsourceUpgrade java-25-openjdk-src-fastdebugUpgrade java-25-openjdk-slowdebug-debuginfoUpgrade java-25-openjdk-jmodsUpgrade java-25-openjdk-srcUpgrade java-25-openjdk-headless-slowdebug-debuginfoUpgrade java-25-openjdk-fastdebugUpgrade java-25-openjdk-headless-slowdebugUpgrade java-25-openjdk-devel-slowdebug-debuginfoUpgrade java-25-openjdk-devel-debuginfo | Feb 5, 2026 | Nov 25, 2025 |
| Suse | — | Upgrade java-1_8_0-ibm-srcUpgrade java-21-openjdk-srcUpgrade java-1_8_0-ibm-develUpgrade java-1_8_0-ibm-pluginUpgrade java-21-openjdk-develUpgrade java-21-openjdk-jmodsUpgrade java-1_8_0-ibm-demoUpgrade java-1_8_0-ibm-alsaUpgrade java-1_8_0-ibm-32bitUpgrade java-21-openjdk-headlessUpgrade java-1_8_0-ibm-devel-32bitUpgrade java-21-openjdk-demoUpgrade java-21-openjdkUpgrade java-1_8_0-ibmUpgrade java-21-openjdk-javadoc | Dec 5, 2025 | Oct 25, 2025 |
| Ubuntu | — | Upgrade openjdk-21-crac-jreUpgrade openjdk-21-crac-jre-headlessUpgrade openjdk-25-crac-jdk-headlessUpgrade openjdk-25-jdkUpgrade openjdk-25-crac-jreUpgrade openjdk-21-jdkUpgrade openjdk-25-jreUpgrade openjdk-25-jre-headlessUpgrade openjdk-25-jre-zeroUpgrade openjdk-25-jdk-headlessUpgrade openjdk-21-crac-jdkUpgrade openjdk-21-crac-jdk-headlessUpgrade openjdk-21-jre-headlessUpgrade openjdk-25-crac-jdkUpgrade openjdk-21-jre-zeroUpgrade openjdk-25-crac-jre-zeroUpgrade openjdk-21-crac-jre-zeroUpgrade openjdk-21-jreUpgrade openjdk-25-crac-jre-headlessUpgrade openjdk-21-jdk-headless | Nov 26, 2025 | Oct 21, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Oct 21, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub