CVE-2026-21945
published 2026-01-20CVE-2026-21945: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.86%
54.5th percentile
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | openjdk-11 | < openjdk-11 11.0.30+7-1~deb11u1 (bullseye) | openjdk-11 11.0.30+7-1~deb11u1 (bullseye) |
| debian | openjdk-17 | < openjdk-11 11.0.30+7-1~deb11u1 (bullseye) | openjdk-11 11.0.30+7-1~deb11u1 (bullseye) |
| debian | openjdk-21 | < openjdk-11 11.0.30+7-1~deb11u1 (bullseye) | openjdk-11 11.0.30+7-1~deb11u1 (bullseye) |
| debian | openjdk-25 | < openjdk-11 11.0.30+7-1~deb11u1 (bullseye) | openjdk-11 11.0.30+7-1~deb11u1 (bullseye) |
| debian | openjdk-8 | < openjdk-11 11.0.30+7-1~deb11u1 (bullseye) | openjdk-11 11.0.30+7-1~deb11u1 (bullseye) |
| oracle | graalvm | — | — |
| oracle | graalvm_for_jdk | — | — |
| oracle | graalvm_for_jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jdk | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle | jre | — | — |
| oracle_corporation | oracle_graalvm_enterprise_edition | — | — |
| oracle_corporation | oracle_graalvm_for_jdk | — | — |
| oracle_corporation | oracle_graalvm_for_jdk | — | — |
| oracle_corporation | oracle_java_se | — | — |
| oracle_corporation | oracle_java_se | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenJDK 17 vulnerabilities
vendor_ubuntu·2026-02-03·CVSS 4.8
CVE-2026-21945 [MEDIUM] OpenJDK 17 vulnerabilities
Title: OpenJDK 17 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 17.
It was discovered that the RMI component of OpenJDK 17 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 17
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 17
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remo
Ubuntu
OpenJDK 21 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] OpenJDK 21 vulnerabilities
Title: OpenJDK 21 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 21.
It was discovered that the RMI component of OpenJDK 21 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 21
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 21
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remo
Ubuntu
OpenJDK 25 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21945 [MEDIUM] OpenJDK 25 vulnerabilities
Title: OpenJDK 25 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 25.
It was discovered that the RMI component of OpenJDK 25 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 25
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 25
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remo
Ubuntu
OpenJDK 8 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21932 [MEDIUM] OpenJDK 8 vulnerabilities
Title: OpenJDK 8 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 8.
It was discovered that the RMI component of OpenJDK 8 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 8
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 8
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote at
Ubuntu
CRaC JDK 21 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21932 [MEDIUM] CRaC JDK 21 vulnerabilities
Title: CRaC JDK 21 vulnerabilities
Summary: Several security issues were fixed in CRaC JDK 21.
It was discovered that the RMI component of CRaC JDK 21 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 21
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of CRaC JDK 21
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated
Ubuntu
OpenJDK 11 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] OpenJDK 11 vulnerabilities
Title: OpenJDK 11 vulnerabilities
Summary: Several security issues were fixed in OpenJDK 11.
It was discovered that the RMI component of OpenJDK 11 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 11
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 11
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remo
Ubuntu
CRaC JDK 25 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21932 [MEDIUM] CRaC JDK 25 vulnerabilities
Title: CRaC JDK 25 vulnerabilities
Summary: Several security issues were fixed in CRaC JDK 25.
It was discovered that the RMI component of CRaC JDK 25 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 25
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of CRaC JDK 25
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated
Ubuntu
CRaC JDK 17 vulnerabilities
vendor_ubuntu·2026-02-02·CVSS 4.8
CVE-2026-21945 [MEDIUM] CRaC JDK 17 vulnerabilities
Title: CRaC JDK 17 vulnerabilities
Summary: Several security issues were fixed in CRaC JDK 17.
It was discovered that the RMI component of CRaC JDK 17 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 17
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of CRaC JDK 17
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated
Red Hat
openjdk: Enhance Certificate Checking (Oracle CPU 2026-01)
vendor_redhat·2026-01-20·CVSS 7.5
CVE-2026-21945 [HIGH] CWE-295 openjdk: Enhance Certificate Checking (Oracle CPU 2026-01)
openjdk: Enhance Certificate Checking (Oracle CPU 2026-01)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr
Oracle
Oracle Oracle Java SE Risk Matrix: Security — CVE-2026-21945
vendor_oracle·2026-01-15·CVSS 7.5
CVE-2026-21945 [HIGH] Oracle Oracle Java SE Risk Matrix: Security — CVE-2026-21945
Oracle Oracle Java SE Risk Matrix: Security vulnerability
CVE: CVE-2026-21945
CVSS: 7.5
Protocol: Multiple
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2026 (JAN 2026)
Debian
CVE-2026-21945: openjdk-11 - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente...
vendor_debian·2026·CVSS 7.5
CVE-2026-21945 [HIGH] CVE-2026-21945: openjdk-11 - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente...
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies t
VulDB
Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition denial of service (EUVD-2026-3564 / Nessus ID 294870)
vuldb·2026-06-11·CVSS 7.5
CVE-2026-21945 [HIGH] Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition denial of service (EUVD-2026-3564 / Nessus ID 294870)
A vulnerability categorized as problematic has been discovered in Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition. This affects an unknown function. The manipulation results in denial of service.
This vulnerability is reported as CVE-2026-21945. The attack can be launched remotely. No exploit exists.
It is advisable to upgrade the affected component.
OSV
openjdk-17 vulnerabilities
osv·2026-02-03·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-17 vulnerabilities
openjdk-17 vulnerabilities
It was discovered that the RMI component of OpenJDK 17 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 17
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 17
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files or leak s
OSV
openjdk-25-crac vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-25-crac vulnerabilities
openjdk-25-crac vulnerabilities
It was discovered that the RMI component of CRaC JDK 25 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 25
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of CRaC JDK 25
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files o
OSV
openjdk-17-crac vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-17-crac vulnerabilities
openjdk-17-crac vulnerabilities
It was discovered that the RMI component of CRaC JDK 17 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 17
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of CRaC JDK 17
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files o
OSV
openjdk-25 vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-25 vulnerabilities
openjdk-25 vulnerabilities
It was discovered that the RMI component of OpenJDK 25 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 25
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 25
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files or leak s
OSV
openjdk-8 vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-8 vulnerabilities
openjdk-8 vulnerabilities
It was discovered that the RMI component of OpenJDK 8 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 8
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 8
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files or leak sensi
OSV
openjdk-21 vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-21 vulnerabilities
openjdk-21 vulnerabilities
It was discovered that the RMI component of OpenJDK 21 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 21
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 21
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files or leak s
OSV
openjdk-21-crac vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-21-crac vulnerabilities
openjdk-21-crac vulnerabilities
It was discovered that the RMI component of CRaC JDK 21 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 21
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of CRaC JDK 21
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files o
OSV
openjdk-lts vulnerabilities
osv·2026-02-02·CVSS 4.8
CVE-2026-21925 [MEDIUM] openjdk-lts vulnerabilities
openjdk-lts vulnerabilities
It was discovered that the RMI component of OpenJDK 11 would establish
RMI TCP endpoint connections to a remote host without setting an
endpoint identification algorithm. An unauthenticated remote attacker
could possibly use this issue to steal sensitive information.
(CVE-2026-21925)
Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 11
could run programs if Desktop.browse() was supplied a filename as a
URI. An unauthenticated remote attacker could possibly use this issue
to execute arbitrary code. (CVE-2026-21932)
Zhihui Chen discovered that the Networking component of OpenJDK 11
was suceptible to a CRLF injection vulnerability via the HttpServer
class. An unauthenticated remote attacker could possibly use this
issue to modify files or leak
GHSA
GHSA-r2mr-x4h2-9chr: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security)
ghsa_unreviewed·2026-01-21
CVE-2026-21945 [HIGH] CWE-400 GHSA-r2mr-x4h2-9chr: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies t
OSV
CVE-2026-21945: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security)
osv·2026-01-20·CVSS 7.5
CVE-2026-21945 [HIGH] CVE-2026-21945: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies t
No detection rules found.
No public exploits indexed.
Tenable
Oracle January 2026 CPU 158 CVEs
blogs_tenable·2026-01-20
Oracle January 2026 CPU 158 CVEs
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Tenable Discovers SSRF Vulnerability in Java TLS Handshakes That Creates DoS Risk
blogs_tenable·2026-01-20
Tenable Discovers SSRF Vulnerability in Java TLS Handshakes That Creates DoS Risk
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Wiz
CVE-2026-21947 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 3.1
CVE-2026-21947 [LOW] CVE-2026-21947 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21947 :
Amazon Corretto JDK vulnerability analysis and mitigation
Vulnerability in Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely
Wiz
CVE-2026-21925 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.8
CVE-2026-21925 [MEDIUM] CVE-2026-21925 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21925 :
Amazon Corretto JDK vulnerability analysis and mitigation
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterpr
Wiz
CVE-2026-21945 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-21945 [HIGH] CVE-2026-21945 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21945 :
Amazon Corretto JDK vulnerability analysis and mitigation
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalV
Wiz
CVE-2026-21932 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.4
CVE-2026-21932 [HIGH] CVE-2026-21932 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21932 :
Amazon Corretto JDK vulnerability analysis and mitigation
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle Gra
Wiz
CVE-2026-21933 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.1
CVE-2026-21933 [MEDIUM] CVE-2026-21933 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-21933 :
Amazon Corretto JDK vulnerability analysis and mitigation
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle Graa
https://www.oracle.com/security-alerts/cpujan2026.htmlhttps://access.redhat.com/errata/RHSA-2026:0847https://access.redhat.com/errata/RHSA-2026:0848https://access.redhat.com/errata/RHSA-2026:0895https://access.redhat.com/errata/RHSA-2026:0897https://access.redhat.com/errata/RHSA-2026:0899https://access.redhat.com/errata/RHSA-2026:0901https://access.redhat.com/errata/RHSA-2026:0927https://access.redhat.com/errata/RHSA-2026:0928https://access.redhat.com/errata/RHSA-2026:0931https://access.redhat.com/errata/RHSA-2026:0932https://access.redhat.com/errata/RHSA-2026:0933https://access.redhat.com/errata/RHSA-2026:1606https://access.redhat.com/errata/RHSA-2026:4832https://access.redhat.com/security/cve/CVE-2026-21945https://bugzilla.redhat.com/show_bug.cgi?id=2429927https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21945.json
2026-01-20
Published