CVE-2026-101737: Medium severity Oracle Java SE vulnerability
Vulnerability in Oracle Java SE (component: Compiler). The supported version that is affected is Oracle Java SE: 26.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openjdk-27to a version that resolves this vulnerability.Fixed in 27.0.1.0.3+1-1 - Upgrade
Upgrade
ubuntu/openjdk-27to a version that resolves this vulnerability.Fixed in 27.0.1.0.3+1-1~26.10.1
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
Oracle Java SE 26.0.2 deployments that accept attacker-controlled data through APIs in the Compiler component are exposed. The advisory gives web services as an example of a relevant delivery path.
Can this be exploited through untrusted Java Web Start applications or applets?
No. The issue can only be exploited by supplying data to the affected component APIs without using untrusted Java Web Start applications or untrusted Java applets.
What access does an attacker need?
An unauthenticated attacker needs network access via multiple protocols and must be able to supply data to the relevant Compiler APIs. Exploitation is rated high complexity and does not require user interaction or privileges.
What is the impact if exploitation succeeds?
Successful exploitation can cause Oracle Java SE to hang or repeatedly crash, resulting in a complete denial of service. The provided CVSS vector identifies no confidentiality or integrity impact.