CVE-2026-47021: Medium severity Oracle Java SE vulnerability
Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE.
Other sources
The regex defined in XbmImageDecoder (matchRegex) is vulnerable to a DoS attack when the input contains a long string without a closing character; due to excessive backtracking.
— Red Hat
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle Java SEto a version that resolves this vulnerability.Fixed in 8u491 - Upgrade
Upgrade
Oracle Java SEto a version that resolves this vulnerability.Fixed in 8u491-perf - Upgrade
Upgrade
Oracle Java SEto a version that resolves this vulnerability.Fixed in 11.0.31 - Upgrade
Upgrade
Oracle Java SEto a version that resolves this vulnerability.Fixed in 17.0.19 - Upgrade
Upgrade
Oracle Java SEto a version that resolves this vulnerability.Fixed in 21.0.11 - Upgrade
Upgrade
Oracle Java SEto a version that resolves this vulnerability.Fixed in 25.0.3 - Upgrade
Upgrade
Oracle Java SEto a version that resolves this vulnerability.Fixed in 26.0.1 - Upgrade
Upgrade
Oracle GraalVM for JDKto a version that resolves this vulnerability.Fixed in 17.0.19 - Upgrade
Upgrade
Oracle GraalVM for JDKto a version that resolves this vulnerability.Fixed in 21.0.11 - Upgrade
Upgrade
Oracle GraalVM Enterprise Editionto a version that resolves this vulnerability.Fixed in 21.3.18 - Compensating control
Mitigate by preventing untrusted code from being executed in affected Java sandbox scenarios (e.g., sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code such as code from the internet), since the described DoS can be triggered through the vulnerable component’s APIs.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47021?
The severity of CVE-2026-47021 is categorized as medium with a score of 5.3.
How do I fix CVE-2026-47021?
To fix CVE-2026-47021, update to the latest version of Oracle JRE, JDK, or GraalVM that addresses the vulnerability.
What type of vulnerability is CVE-2026-47021?
CVE-2026-47021 is a denial-of-service (DoS) vulnerability caused by excessive backtracking in a regex pattern.
Which products are affected by CVE-2026-47021?
CVE-2026-47021 affects Oracle JRE, Oracle JDK, Oracle GraalVM, and Oracle GraalVM Enterprise Edition.
What is the potential impact of exploiting CVE-2026-47021?
Exploiting CVE-2026-47021 can lead to application denial of service due to prolonged excessive backtracking.