CVE-2025-30691
First published: Tue Apr 15 2025(Updated: )
Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 21.0.6, 24; Oracle GraalVM for JDK: 21.0.6 and 24. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Oracle Java SE 7 | ||
| Oracle GraalVM for JDK |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What are the affected versions for CVE-2025-30691?
The affected versions for CVE-2025-30691 are Oracle Java SE: 21.0.6 and 24, as well as Oracle GraalVM for JDK: 21.0.6 and 24.
What is the severity of CVE-2025-30691?
CVE-2025-30691 has been classified as a difficult to exploit vulnerability.
How can I mitigate CVE-2025-30691?
To mitigate CVE-2025-30691, users should update to the latest patched versions of Oracle Java SE and Oracle GraalVM.
Who can exploit CVE-2025-30691?
CVE-2025-30691 can be exploited by unauthenticated attackers with network access via multiple protocols.
What component is affected by CVE-2025-30691?
CVE-2025-30691 affects the Compiler component of Oracle Java SE.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/type
- agent/first-publish-date
- agent/severity
- agent/source
- agent/author
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/last-modified-date
- agent/weakness
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/oracle
- canonical/oracle java se 7
- canonical/oracle graalvm for jdk