CVE-2026-60589: Infoleak
URIDereferencer does not properly use the base URI from XMLCryptoContext when downloading data.
Other sources
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure applications do not use Untrusted Java Web Start applications or Untrusted Java applets; this vulnerability can only be exploited by supplying data to the specified component via APIs without using Untrusted Java Web Start applications or Untrusted Java applets (e.g., through a web service).
- Compensating control
Treat access to any APIs that can provide input to the URIDereferencer/XMLCryptoContext “base URI” handling as untrusted; prevent unauthenticated network callers from supplying crafted data to those APIs where possible.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected deployments are Oracle Java SE 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, and 26.0.2; Oracle GraalVM for JDK 17.0.20 and 21.0.12; and Oracle GraalVM Enterprise Edition 21.3.19. Exploitation requires that an attacker can supply data to APIs in the Security component, such as through a web service.
Does exploitation require credentials, user interaction, or Java Web Start or applet content?
No credentials or user interaction are required, and the attacker needs network access through multiple protocols. The issue is not exploitable through untrusted Java Web Start applications or untrusted Java applets; it requires supplying data directly to the relevant APIs.
What is the expected impact if exploitation succeeds?
A successful attack can provide unauthorized read access to a subset of data accessible to the affected Java SE or GraalVM product. The provided CVSS vector indicates a low confidentiality impact, with no integrity or availability impact.