CVE-2026-21933
published 2026-01-20CVE-2026-21933: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported…
PriorityP431medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.26%
17.7th percentile
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openjdk-11 | < openjdk-11 11.0.30+7-1~deb11u1 (bullseye) | openjdk-11 11.0.30+7-1~deb11u1 (bullseye) |
| debian | openjdk-17 | < openjdk-11 11.0.30+7-1~deb11u1 (bullseye) | openjdk-11 11.0.30+7-1~deb11u1 (bullseye) |
| debian | openjdk-21 | < openjdk-11 11.0.30+7-1~deb11u1 (bullseye) | openjdk-11 11.0.30+7-1~deb11u1 (bullseye) |
| debian | openjdk-25 | < openjdk-11 11.0.30+7-1~deb11u1 (bullseye) | openjdk-11 11.0.30+7-1~deb11u1 (bullseye) |
| debian | openjdk-8 | < openjdk-11 11.0.30+7-1~deb11u1 (bullseye) | openjdk-11 11.0.30+7-1~deb11u1 (bullseye) |
| oracle | graalvm | — | — |
| oracle | graalvm_for_jdk | — | — |
| oracle | graalvm_for_jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle_corporation | oracle_graalvm_enterprise_edition | — | — |
| oracle_corporation | oracle_graalvm_for_jdk | — | — |
| oracle_corporation | oracle_graalvm_for_jdk | — | — |
| oracle_corporation | oracle_java_se | — | — |
| oracle_corporation | oracle_java_se | — | — |
| oracle_corporation | oracle_java_se | — | — |
| oracle_corporation | oracle_java_se | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
osv6.1MEDIUM
vendor_debian6.1MEDIUM
vendor_oracle6.1MEDIUM
vendor_redhat6.1MEDIUM
vendor_ubuntu4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition Remote Code Execution (EUVD-2026-3576 / Nessus ID 294885)
vuldb·2026-06-11·CVSS 6.1
CVE-2026-21933 [MEDIUM] Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition Remote Code Execution (EUVD-2026-3576 / Nessus ID 294885)
A vulnerability labeled as critical has been found in Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition. Affected is an unknown function. Such manipulation leads to Remote Code Execution.
This vulnerability is traded as CVE-2026-21933. The attack may be launched remotely. There is no exploit available.
The affected component should be upgraded.
OSV
openjdk-17 vulnerabilities
osv·2026-02-03·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-17 vulnerabilities
openjdk-17 vulnerabilities
It was discovered that the RMI component of OpenJDK 17 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 17
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 17
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files or leak s
OSV
openjdk-25-crac vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-25-crac vulnerabilities
openjdk-25-crac vulnerabilities
It was discovered that the RMI component of CRaC JDK 25 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 25
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of CRaC JDK 25
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files o
OSV
openjdk-17-crac vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-17-crac vulnerabilities
openjdk-17-crac vulnerabilities
It was discovered that the RMI component of CRaC JDK 17 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 17
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of CRaC JDK 17
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files o
OSV
openjdk-25 vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-25 vulnerabilities
openjdk-25 vulnerabilities
It was discovered that the RMI component of OpenJDK 25 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 25
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 25
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files or leak s
OSV
openjdk-8 vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-8 vulnerabilities
openjdk-8 vulnerabilities
It was discovered that the RMI component of OpenJDK 8 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 8
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 8
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files or leak sensi
OSV
openjdk-21 vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-21 vulnerabilities
openjdk-21 vulnerabilities
It was discovered that the RMI component of OpenJDK 21 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 21
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 21
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files or leak s
OSV
openjdk-21-crac vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-21-crac vulnerabilities
openjdk-21-crac vulnerabilities
It was discovered that the RMI component of CRaC JDK 21 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 21
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of CRaC JDK 21
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files o
OSV
openjdk-lts vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-lts vulnerabilities
openjdk-lts vulnerabilities
It was discovered that the RMI component of OpenJDK 11 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 11
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 11
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files or leak
GHSA
GHSA-5rm3-299f-6m9v: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking)
ghsa_unreviewed·2026-01-21
CVE-2026-21933 [MEDIUM] GHSA-5rm3-299f-6m9v: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (sc
OSV
CVE-2026-21933: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking)
osv·2026-01-20·CVSS 6.1
CVE-2026-21933 [MEDIUM] CVE-2026-21933: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (sc
Ubuntu
OpenJDK 17 vulnerabilities
vendor_ubuntu·2026-02-03·CVSS 4.8
CVE-2026-21945 [MEDIUM] OpenJDK 17 vulnerabilities
Title: OpenJDK 17 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 17.
It was discovered that the RMI component of OpenJDK 17 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 17
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 17
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remo
Ubuntu
OpenJDK 21 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] OpenJDK 21 vulnerabilities
Title: OpenJDK 21 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 21.
It was discovered that the RMI component of OpenJDK 21 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 21
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 21
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remo
Ubuntu
OpenJDK 25 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21945 [MEDIUM] OpenJDK 25 vulnerabilities
Title: OpenJDK 25 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 25.
It was discovered that the RMI component of OpenJDK 25 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 25
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 25
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remo
Ubuntu
OpenJDK 8 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21932 [MEDIUM] OpenJDK 8 vulnerabilities
Title: OpenJDK 8 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 8.
It was discovered that the RMI component of OpenJDK 8 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 8
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 8
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote at
Ubuntu
CRaC JDK 21 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21932 [MEDIUM] CRaC JDK 21 vulnerabilities
Title: CRaC JDK 21 vulnerabilities
Summary: Several security issues were fixed in CRaC JDK 21.
It was discovered that the RMI component of CRaC JDK 21 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 21
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of CRaC JDK 21
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated
Ubuntu
OpenJDK 11 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] OpenJDK 11 vulnerabilities
Title: OpenJDK 11 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 11.
It was discovered that the RMI component of OpenJDK 11 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 11
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 11
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remo
Ubuntu
CRaC JDK 25 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21932 [MEDIUM] CRaC JDK 25 vulnerabilities
Title: CRaC JDK 25 vulnerabilities
Summary: Several security issues were fixed in CRaC JDK 25.
It was discovered that the RMI component of CRaC JDK 25 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 25
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of CRaC JDK 25
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated
Ubuntu
CRaC JDK 17 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21945 [MEDIUM] CRaC JDK 17 vulnerabilities
Title: CRaC JDK 17 vulnerabilities
Summary: Several security issues were fixed in CRaC JDK 17.
It was discovered that the RMI component of CRaC JDK 17 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 17
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of CRaC JDK 17
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated
Red Hat
openjdk: Improve HttpServer Request handling (Oracle CPU 2026-01)
vendor_redhat·2026-01-20·CVSS 6.1
CVE-2026-21933 [MEDIUM] CWE-93 openjdk: Improve HttpServer Request handling (Oracle CPU 2026-01)
openjdk: Improve HttpServer Request handling (Oracle CPU 2026-01)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterpris
Oracle
Oracle Oracle Java SE Risk Matrix: Networking — CVE-2026-21933
vendor_oracle·2026-01-15·CVSS 6.1
CVE-2026-21933 [MEDIUM] Oracle Oracle Java SE Risk Matrix: Networking — CVE-2026-21933
Oracle Oracle Java SE Risk Matrix: Networking vulnerability
CVE: CVE-2026-21933
CVSS: 6.1
Protocol: Multiple
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2026 (JAN 2026)
Debian
CVE-2026-21933: openjdk-11 - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente...
vendor_debian·2026·CVSS 6.1
CVE-2026-21933 [MEDIUM] CVE-2026-21933: openjdk-11 - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente...
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (sc
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-21947 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 3.1
CVE-2026-21947 [LOW] CVE-2026-21947 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21947 :
Amazon Corretto JDK vulnerability analysis and mitigation
Vulnerability in Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely
Wiz
CVE-2026-21925 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.8
CVE-2026-21925 [MEDIUM] CVE-2026-21925 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21925 :
Amazon Corretto JDK vulnerability analysis and mitigation
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterpr
Wiz
CVE-2026-21945 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-21945 [HIGH] CVE-2026-21945 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21945 :
Amazon Corretto JDK vulnerability analysis and mitigation
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalV
Wiz
CVE-2026-21932 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.4
CVE-2026-21932 [HIGH] CVE-2026-21932 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21932 :
Amazon Corretto JDK vulnerability analysis and mitigation
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle Gra
Wiz
CVE-2026-21933 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.1
CVE-2026-21933 [MEDIUM] CVE-2026-21933 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21933 :
Amazon Corretto JDK vulnerability analysis and mitigation
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle Graa
Bugzilla
CVE-2026-21933 openjdk: Improve HttpServer Request handling (Oracle CPU 2026-01)
bugzilla·2026-01-15·CVSS 6.1
CVE-2026-21933 [MEDIUM] CVE-2026-21933 openjdk: Improve HttpServer Request handling (Oracle CPU 2026-01)
CVE-2026-21933 openjdk: Improve HttpServer Request handling (Oracle CPU 2026-01)
There is a CRLF injection vulnerability in HttpServer in JDK which may
lead to potential XSS.
Discussion:
This issue has been addressed in the following products:
OPENJDK ELS 11.0.30
Via RHSA-2026:0849 https://access.redhat.com/errata/RHSA-2026:0849
---
This issue has been addressed in the following products:
Red Hat OpenShift Lightspeed
Via RHSA-2026:1070 https://access.redhat.com/errata/RHSA-2026:1070 https://coolgamesonline.io
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Via RHSA-2026:0931 https://access.redhat.com/errata/RHSA-2026:0931
---
OpenJDK-8 upstream commit:
https://github.com/openjdk/jdk8u/commit/332d177c5504e067406
2026-01-20
Published