CVE-2025-53066
published 2025-10-21CVE-2025-53066: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions…
PriorityP349high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.65%
46.9th percentile
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Affected
33 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openjdk-11 | < openjdk-11 11.0.29+6-1~deb11u1 (bullseye) | openjdk-11 11.0.29+6-1~deb11u1 (bullseye) |
| debian | openjdk-17 | < openjdk-11 11.0.29+6-1~deb11u1 (bullseye) | openjdk-11 11.0.29+6-1~deb11u1 (bullseye) |
| debian | openjdk-21 | < openjdk-11 11.0.29+6-1~deb11u1 (bullseye) | openjdk-11 11.0.29+6-1~deb11u1 (bullseye) |
| debian | openjdk-25 | < openjdk-11 11.0.29+6-1~deb11u1 (bullseye) | openjdk-11 11.0.29+6-1~deb11u1 (bullseye) |
| debian | openjdk-8 | < openjdk-11 11.0.29+6-1~deb11u1 (bullseye) | openjdk-11 11.0.29+6-1~deb11u1 (bullseye) |
| msrc | azl3_kernel_6.6.57.1-7_on_azure_linux_3.0 | — | — |
| msrc | azl3_kernel_6.6.64.2-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_kernel_5.15.167.1-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.173.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| oracle | graalvm | — | — |
| oracle | graalvm_for_jdk | — | — |
| oracle | graalvm_for_jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle_corporation | oracle_graalvm_enterprise_edition | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu5.9MEDIUM
vendor_msrc5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
openjdk-21-crac vulnerabilities
osv·2025-12-01·CVSS 5.9
CVE-2025-53057 [MEDIUM] openjdk-21-crac vulnerabilities
openjdk-21-crac vulnerabilities
Jinfeng Guo discovered that the Security component of CRaC JDK 21 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of CRaC JDK 21 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated remote
attacker could possibly use this issue to modify files or leak sensitive
information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of CRaC JDK 21
contained an issue where certain Strings built with StringBuilder returned
an incorrect result for String.equals() checks. An unauthenticated remote
attacker could possibly use this
OSV
openjdk-17-crac vulnerabilities
osv·2025-12-01·CVSS 5.9
CVE-2025-53057 [MEDIUM] openjdk-17-crac vulnerabilities
openjdk-17-crac vulnerabilities
Jinfeng Guo discovered that the Security component of CRaC JDK 17 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of CRaC JDK 17 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://openjdk.org/groups/vulnerability/advisories/2025-10-21
OSV
openjdk-25-crac vulnerabilities
osv·2025-12-01·CVSS 5.9
CVE-2025-53057 [MEDIUM] openjdk-25-crac vulnerabilities
openjdk-25-crac vulnerabilities
Jinfeng Guo discovered that the Security component of CRaC JDK 25 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of CRaC JDK 25 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of CRaC JDK
25 contained an issue where certain Strings built with StringBuilder
returned an incorrect result for String.equals() checks. An unauthenticated
remote attacker could possibly use this
OSV
openjdk-8 vulnerabilities
osv·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] openjdk-8 vulnerabilities
openjdk-8 vulnerabilities
Jinfeng Guo discovered that the Security component of OpenJDK 8 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 8 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://openjdk.org/groups/vulnerability/advisories/2025-10-21
OSV
openjdk-17 vulnerabilities
osv·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] openjdk-17 vulnerabilities
openjdk-17 vulnerabilities
Jinfeng Guo discovered that the Security component of OpenJDK 17 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 17 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://openjdk.org/groups/vulnerability/advisories/2025-10-21
OSV
openjdk-21 vulnerabilities
osv·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] openjdk-21 vulnerabilities
openjdk-21 vulnerabilities
Jinfeng Guo discovered that the Security component of OpenJDK 21 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 21 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated remote
attacker could possibly use this issue to modify files or leak sensitive
information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of OpenJDK 21
contained an issue where certain Strings built with StringBuilder returned
an incorrect result for String.equals() checks. An unauthenticated remote
attacker could possibly use this issue t
OSV
openjdk-lts vulnerabilities
osv·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] openjdk-lts vulnerabilities
openjdk-lts vulnerabilities
Jinfeng Guo discovered that the Security component of OpenJDK 11 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 11 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://openjdk.org/groups/vulnerability/advisories/2025-10-21
OSV
openjdk-25 vulnerabilities
osv·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] openjdk-25 vulnerabilities
openjdk-25 vulnerabilities
Jinfeng Guo discovered that the Security component of OpenJDK 25 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 25 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated remote
attacker could possibly use this issue to modify files or leak sensitive
information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of OpenJDK 21
contained an issue where certain Strings built with StringBuilder returned
an incorrect result for String.equals() checks. An unauthenticated remote
attacker could possibly use this issue t
OSV
CVE-2025-53066: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP)
osv·2025-10-21·CVSS 7.5
CVE-2025-53066 [HIGH] CVE-2025-53066: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in t
GHSA
GHSA-9v5j-pxpg-qprp: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP)
ghsa_unreviewed·2025-10-21
CVE-2025-53066 [HIGH] CWE-200 GHSA-9v5j-pxpg-qprp: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in t
Ubuntu
CRaC JDK 25 vulnerabilities
vendor_ubuntu·2025-12-01·CVSS 5.9
CVE-2025-53057 [MEDIUM] CRaC JDK 25 vulnerabilities
Title: CRaC JDK 25 vulnerabilities
Summary: Several security issues were fixed in CRaC JDK 25.
Jinfeng Guo discovered that the Security component of CRaC JDK 25 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of CRaC JDK 25 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of CRaC JDK
25 contained an issue where certain Strings built with StringBuilder
returned an incorrect result for String.equals() ch
Ubuntu
CRaC JDK 21 vulnerabilities
vendor_ubuntu·2025-12-01·CVSS 5.9
CVE-2025-53057 [MEDIUM] CRaC JDK 21 vulnerabilities
Title: CRaC JDK 21 vulnerabilities
Summary: Several security issues were fixed in CRaC JDK 21.
Jinfeng Guo discovered that the Security component of CRaC JDK 21 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of CRaC JDK 21 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated remote
attacker could possibly use this issue to modify files or leak sensitive
information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of CRaC JDK 21
contained an issue where certain Strings built with StringBuilder returned
an incorrect result for String.equals() ch
Ubuntu
CRaC JDK 17 vulnerabilities
vendor_ubuntu·2025-12-01·CVSS 5.9
CVE-2025-53057 [MEDIUM] CRaC JDK 17 vulnerabilities
Title: CRaC JDK 17 vulnerabilities
Summary: Several security issues were fixed in CRaC JDK 17.
Jinfeng Guo discovered that the Security component of CRaC JDK 17 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of CRaC JDK 17 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://openjdk.org/gro
Ubuntu
OpenJDK 11 vulnerabilities
vendor_ubuntu·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] OpenJDK 11 vulnerabilities
Title: OpenJDK 11 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 11.
Jinfeng Guo discovered that the Security component of OpenJDK 11 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 11 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://openjdk.org/groups/
Ubuntu
OpenJDK 17 vulnerabilities
vendor_ubuntu·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] OpenJDK 17 vulnerabilities
Title: OpenJDK 17 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 17.
Jinfeng Guo discovered that the Security component of OpenJDK 17 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 17 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://openjdk.org/groups/
Ubuntu
OpenJDK 21 vulnerabilities
vendor_ubuntu·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] OpenJDK 21 vulnerabilities
Title: OpenJDK 21 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 21.
Jinfeng Guo discovered that the Security component of OpenJDK 21 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 21 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated remote
attacker could possibly use this issue to modify files or leak sensitive
information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of OpenJDK 21
contained an issue where certain Strings built with StringBuilder returned
an incorrect result for String.equals() checks.
Ubuntu
OpenJDK 25 vulnerabilities
vendor_ubuntu·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] OpenJDK 25 vulnerabilities
Title: OpenJDK 25 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 25.
Jinfeng Guo discovered that the Security component of OpenJDK 25 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 25 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated remote
attacker could possibly use this issue to modify files or leak sensitive
information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of OpenJDK 21
contained an issue where certain Strings built with StringBuilder returned
an incorrect result for String.equals() checks.
Ubuntu
OpenJDK 8 vulnerabilities
vendor_ubuntu·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] OpenJDK 8 vulnerabilities
Title: OpenJDK 8 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 8.
Jinfeng Guo discovered that the Security component of OpenJDK 8 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 8 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://openjdk.org/groups/vuln
Red Hat
openjdk: Enhance Path Factories (Oracle CPU 2025-10)
vendor_redhat·2025-10-21·CVSS 7.5
CVE-2025-53066 [HIGH] openjdk: Enhance Path Factories (Oracle CPU 2025-10)
openjdk: Enhance Path Factories (Oracle CPU 2025-10)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note:
Oracle
Oracle Oracle Java SE Risk Matrix: JAXP — CVE-2025-53066
vendor_oracle·2025-10-15·CVSS 7.5
CVE-2025-53066 [HIGH] Oracle Oracle Java SE Risk Matrix: JAXP — CVE-2025-53066
Oracle Oracle Java SE Risk Matrix: JAXP vulnerability
CVE: CVE-2025-53066
CVSS: 7.5
Protocol: Multiple
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2025 (OCT 2025)
Red Hat
kernel: qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
vendor_redhat·2025-05-02·CVSS 5.5
CVE-2023-53066 [MEDIUM] CWE-476 kernel: qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
kernel: qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
In the Linux kernel, the following vulnerability has been resolved:
qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
We have to make sure that the info returned by the helper is valid
before using it.
Found by Linux Verification Center (linuxtesting.org) with the SVACE
static analysis tool.
A flaw was found in the QED SR-IOV support in the Linux kernel. Improper validation of the value returned from the qed_iov_get_vf_info function can cause a NULL pointer dereference and result in a denial of service.
Statement: This issue has been fixed in Red Hat Enterprise Linux 9.6 via RHSA-2025:6966 [1].
[1]. https://access.redhat.com/errata/RHSA-2025:6966
Package: kernel (Red Hat Enterprise Linux 10) - Not
Debian
CVE-2025-53066: openjdk-11 - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente...
vendor_debian·2025·CVSS 7.5
CVE-2025-53066 [HIGH] CVE-2025-53066: openjdk-11 - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente...
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in t
Microsoft
nfs: Fix KMSAN warning in decode_getfattr_attrs()
vendor_msrc·2024-11-12·CVSS 5.5
CVE-2024-53066 [MEDIUM] nfs: Fix KMSAN warning in decode_getfattr_attrs()
nfs: Fix KMSAN warning in decode_getfattr_attrs()
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.micro
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-21
Published