CVE-2026-47027: Medium severity Oracle Java SE vulnerability
Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE.
Other sources
The processImpl() method in SignatureFileVerifier exhibits O(n^2) time complexity when verifying JAR files where different entries have different signer combinations, potentially leading to DoS.
— Red Hat
Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle Java SE (Libraries)to a version that resolves this vulnerability.Fixed in 8u491 - Upgrade
Upgrade
Oracle Java SE (Libraries)to a version that resolves this vulnerability.Fixed in 8u491-perf - Upgrade
Upgrade
Oracle Java SE (Libraries)to a version that resolves this vulnerability.Fixed in 11.0.31 - Upgrade
Upgrade
Oracle Java SE (Libraries)to a version that resolves this vulnerability.Fixed in 17.0.19 - Upgrade
Upgrade
Oracle Java SE (Libraries)to a version that resolves this vulnerability.Fixed in 21.0.11 - Upgrade
Upgrade
Oracle Java SE (Libraries)to a version that resolves this vulnerability.Fixed in 25.0.3 - Upgrade
Upgrade
Oracle Java SE (Libraries)to a version that resolves this vulnerability.Fixed in 26.0.1 - Upgrade
Upgrade
Oracle GraalVM for JDK (Libraries)to a version that resolves this vulnerability.Fixed in 17.0.19 - Upgrade
Upgrade
Oracle GraalVM for JDK (Libraries)to a version that resolves this vulnerability.Fixed in 21.0.11 - Upgrade
Upgrade
Oracle GraalVM Enterprise Edition (Libraries)to a version that resolves this vulnerability.Fixed in 21.3.18 - Compensating control
If affected Java sandboxed Java Web Start applications or Java applets load and run untrusted code (e.g., from the internet), reduce exposure by preventing untrusted code from being loaded/executed in these sandboxed environments (since successful attacks can cause partial denial of service of Java SE/Oracle Java SE).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47027?
The severity of CVE-2026-47027 is classified as medium with a score of 5.3.
How does CVE-2026-47027 affect JAR file verification?
CVE-2026-47027 affects JAR file verification by introducing O(n^2) time complexity in the processImpl() method, which can lead to a Denial of Service (DoS) attack.
Which versions of Oracle Java are affected by CVE-2026-47027?
CVE-2026-47027 affects supported versions of Oracle JRE, Oracle JDK, Oracle GraalVM for JDK, and Oracle Java SE.
What mitigation strategies exist for CVE-2026-47027?
Mitigation of CVE-2026-47027 can include updating to the latest version of the affected Oracle Java components to prevent potential DoS attacks.
Is there a risk of data loss with CVE-2026-47027?
CVE-2026-47027 has no reported risk of data loss, but it can lead to application downtime due to DoS.