CVE-2025-21587

CWE-284 — Improper Access ControlCWE-20821 documents8 sources
Severity
7.4HIGH
EPSS
0.6%
top 31.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Oracle Corporation Oracle Graalvm Enterprise EditionOracle Corporation Oracle Graalvm FOR JDKOracle Corporation Oracle Java SE+4 more
Timeline
PublishedApr 15
Latest updateMay 26

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE:8u441, 8u441-perf, 11.0.26, 17.0.14, 21.0.6, 24; Oracle GraalVM for JDK:17.0.14, 21.0.6, 24; Oracle GraalVM Enterprise Edition:20.3.17 and 21.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM f…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 2.2 | Impact: 5.2

Affected Packages16 packages

▶NVDoracle/graalvm5 versions+4
▶CVEListV5oracle_corporation/oracle_java_se6 versions+5
▶CVEListV5oracle_corporation/oracle_graalvm_for_jdk17.0.14, 21.0.6, 24+2
▶NVDoracle/jdk5 versions+4

🔴Vulnerability Details

10
OSV
openjdk-21-crac vulnerabilities↗2025-05-26
▶
OSV
openjdk-17-crac vulnerabilities↗2025-05-26
▶
OSV
openjdk-17 vulnerabilities↗2025-05-06
▶
OSV
openjdk-lts vulnerabilities↗2025-05-06
▶
OSV
openjdk-8 vulnerabilities↗2025-05-06
▶

📋Vendor Advisories

10
Ubuntu
CRaC JDK 21 vulnerabilities↗2025-05-26
▶
Ubuntu
CRaC JDK 17 vulnerabilities↗2025-05-26
▶
Ubuntu
OpenJDK 24 vulnerabilities↗2025-05-06
▶
Ubuntu
OpenJDK 21 vulnerabilities↗2025-05-06
▶
Ubuntu
OpenJDK 8 vulnerabilities↗2025-05-06
▶
CVE-2025-21587 (HIGH CVSS 7.4) | Vulnerability in the Oracle Java SE | cvebase.io