CVE-2026-47027: Medium severity Oracle Java SE vulnerability
Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE.
Other sources
The processImpl() method in SignatureFileVerifier exhibits O(n^2) time complexity when verifying JAR files where different entries have different signer combinations, potentially leading to DoS.
— Red Hat
Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openjdk-11to a version that resolves this vulnerability.Fixed in 11.0.32.1+1-1~deb11u1Fixed in 11.0.32.1+1-1 - Upgrade
Upgrade
debian/openjdk-17to a version that resolves this vulnerability.Fixed in 17.0.20.1+1-1~deb11u1Fixed in 17.0.20.1+1-1~deb12u1Fixed in 17.0.20.1+1-1 - Upgrade
Upgrade
debian/openjdk-21to a version that resolves this vulnerability.Fixed in 21.0.12.1+1-1~deb13u1Fixed in 21.0.12.1+1-1 - Upgrade
Upgrade
debian/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.4.1+1-1~deb13u1Fixed in 25.0.4+7-1Fixed in 25.0.4.1+1-1 - Upgrade
Upgrade
debian/openjdk-26to a version that resolves this vulnerability.Fixed in 26.0.2.1+1-1 - Upgrade
Upgrade
debian/openjdk-8to a version that resolves this vulnerability.Fixed in 8u504-ga-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47027?
The severity of CVE-2026-47027 is classified as medium with a score of 5.3.
How does CVE-2026-47027 affect JAR file verification?
CVE-2026-47027 affects JAR file verification by introducing O(n^2) time complexity in the processImpl() method, which can lead to a Denial of Service (DoS) attack.
Which versions of Oracle Java are affected by CVE-2026-47027?
CVE-2026-47027 affects supported versions of Oracle JRE, Oracle JDK, Oracle GraalVM for JDK, and Oracle Java SE.
What mitigation strategies exist for CVE-2026-47027?
Mitigation of CVE-2026-47027 can include updating to the latest version of the affected Oracle Java components to prevent potential DoS attacks.
Is there a risk of data loss with CVE-2026-47027?
CVE-2026-47027 has no reported risk of data loss, but it can lead to application downtime due to DoS.