CVE-2025-61748
published 2025-10-21CVE-2025-61748: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported…
PriorityP416low3.7CVSS 3.1
AVNACHPRNUINSUCNILAN
EPSS
0.36%
27.6th percentile
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openjdk-21 | < openjdk-21 21.0.9+10-1 (forky) | openjdk-21 21.0.9+10-1 (forky) |
| debian | openjdk-25 | < openjdk-21 21.0.9+10-1 (forky) | openjdk-21 21.0.9+10-1 (forky) |
| oracle | graalvm | — | — |
| oracle | graalvm_for_jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle_corporation | oracle_graalvm_enterprise_edition | — | — |
| oracle_corporation | oracle_graalvm_for_jdk | — | — |
| oracle_corporation | oracle_java_se | — | — |
| oracle_corporation | oracle_java_se | — | — |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
osv5.9MEDIUM
vendor_ubuntu5.9MEDIUM
vendor_debian3.7LOW
vendor_oracle3.7LOW
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
CRaC JDK 25 vulnerabilities
vendor_ubuntu·2025-12-01·CVSS 5.9
CVE-2025-53057 [MEDIUM] CRaC JDK 25 vulnerabilities
Title: CRaC JDK 25 vulnerabilities
Summary: Several security issues were fixed in CRaC JDK 25.
Jinfeng Guo discovered that the Security component of CRaC JDK 25 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of CRaC JDK 25 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of CRaC JDK
25 contained an issue where certain Strings built with StringBuilder
returned an incorrect result for String.equals() ch
Ubuntu
CRaC JDK 21 vulnerabilities
vendor_ubuntu·2025-12-01·CVSS 5.9
CVE-2025-53057 [MEDIUM] CRaC JDK 21 vulnerabilities
Title: CRaC JDK 21 vulnerabilities
Summary: Several security issues were fixed in CRaC JDK 21.
Jinfeng Guo discovered that the Security component of CRaC JDK 21 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of CRaC JDK 21 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated remote
attacker could possibly use this issue to modify files or leak sensitive
information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of CRaC JDK 21
contained an issue where certain Strings built with StringBuilder returned
an incorrect result for String.equals() ch
Ubuntu
OpenJDK 21 vulnerabilities
vendor_ubuntu·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] OpenJDK 21 vulnerabilities
Title: OpenJDK 21 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 21.
Jinfeng Guo discovered that the Security component of OpenJDK 21 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 21 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated remote
attacker could possibly use this issue to modify files or leak sensitive
information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of OpenJDK 21
contained an issue where certain Strings built with StringBuilder returned
an incorrect result for String.equals() checks.
Ubuntu
OpenJDK 25 vulnerabilities
vendor_ubuntu·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] OpenJDK 25 vulnerabilities
Title: OpenJDK 25 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 25.
Jinfeng Guo discovered that the Security component of OpenJDK 25 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 25 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated remote
attacker could possibly use this issue to modify files or leak sensitive
information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of OpenJDK 21
contained an issue where certain Strings built with StringBuilder returned
an incorrect result for String.equals() checks.
Red Hat
openjdk: Enhance String handling (Oracle CPU 2025-10)
vendor_redhat·2025-10-21·CVSS 3.7
CVE-2025-61748 [LOW] CWE-581 openjdk: Enhance String handling (Oracle CPU 2025-10)
openjdk: Enhance String handling (Oracle CPU 2025-10)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using
Oracle
Oracle Oracle Java SE Risk Matrix: Libraries — CVE-2025-61748
vendor_oracle·2025-10-15·CVSS 3.7
CVE-2025-61748 [LOW] Oracle Oracle Java SE Risk Matrix: Libraries — CVE-2025-61748
Oracle Oracle Java SE Risk Matrix: Libraries vulnerability
CVE: CVE-2025-61748
CVSS: 3.7
Protocol: Multiple
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2025 (OCT 2025)
Debian
CVE-2025-61748: openjdk-21 - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente...
vendor_debian·2025·CVSS 3.7
CVE-2025-61748 [LOW] CVE-2025-61748: openjdk-21 - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente...
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web se
OSV
openjdk-21-crac vulnerabilities
osv·2025-12-01·CVSS 5.9
CVE-2025-53057 [MEDIUM] openjdk-21-crac vulnerabilities
openjdk-21-crac vulnerabilities
Jinfeng Guo discovered that the Security component of CRaC JDK 21 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of CRaC JDK 21 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated remote
attacker could possibly use this issue to modify files or leak sensitive
information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of CRaC JDK 21
contained an issue where certain Strings built with StringBuilder returned
an incorrect result for String.equals() checks. An unauthenticated remote
attacker could possibly use this
OSV
openjdk-25-crac vulnerabilities
osv·2025-12-01·CVSS 5.9
CVE-2025-53057 [MEDIUM] openjdk-25-crac vulnerabilities
openjdk-25-crac vulnerabilities
Jinfeng Guo discovered that the Security component of CRaC JDK 25 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of CRaC JDK 25 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated
remote attacker could possibly use this issue to modify files or leak
sensitive information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of CRaC JDK
25 contained an issue where certain Strings built with StringBuilder
returned an incorrect result for String.equals() checks. An unauthenticated
remote attacker could possibly use this
OSV
openjdk-21 vulnerabilities
osv·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] openjdk-21 vulnerabilities
openjdk-21 vulnerabilities
Jinfeng Guo discovered that the Security component of OpenJDK 21 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 21 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated remote
attacker could possibly use this issue to modify files or leak sensitive
information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of OpenJDK 21
contained an issue where certain Strings built with StringBuilder returned
an incorrect result for String.equals() checks. An unauthenticated remote
attacker could possibly use this issue t
OSV
openjdk-25 vulnerabilities
osv·2025-11-24·CVSS 5.9
CVE-2025-53057 [MEDIUM] openjdk-25 vulnerabilities
openjdk-25 vulnerabilities
Jinfeng Guo discovered that the Security component of OpenJDK 25 did not
correctly handle certain representations of encoded strings. An
unauthenticated remote attacker could possibly use this issue to modify
files or leak sensitive information. (CVE-2025-53057)
Darius Bohni discovered that the JAXP component of OpenJDK 25 was
vulnerable to a XML External Entity (XEE) attack. An unauthenticated remote
attacker could possibly use this issue to modify files or leak sensitive
information. (CVE-2025-53066)
Yakov Shafranovich discovered that the Libraries component of OpenJDK 21
contained an issue where certain Strings built with StringBuilder returned
an incorrect result for String.equals() checks. An unauthenticated remote
attacker could possibly use this issue t
OSV
CVE-2025-61748: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)
osv·2025-10-21·CVSS 3.7
CVE-2025-61748 [LOW] CVE-2025-61748: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web se
GHSA
GHSA-6ch4-24w6-v6jv: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)
ghsa_unreviewed·2025-10-21
CVE-2025-61748 [LOW] CWE-284 GHSA-6ch4-24w6-v6jv: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web se
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-21
Published