CVE-2026-70907: Medium severity Oracle Java SE (JSSE) vulnerability
A client can repeatedly replay a ClientHello to a TLS 1.3 server in order to cause the server to emit an unbounded number of HelloRetryRequest records.
Other sources
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openjdk-11to a version that resolves this vulnerability.Fixed in 11.0.33~4ea-1 - Upgrade
Upgrade
debian/openjdk-17to a version that resolves this vulnerability.Fixed in 17.0.20.1+1-1~deb12u1Fixed in 17.0.21~6ea-1 - Upgrade
Upgrade
debian/openjdk-21to a version that resolves this vulnerability.Fixed in 21.0.12.1+1-1~deb13u1Fixed in 21.0.12.1+1-1Fixed in 21.0.13~6ea-1 - Upgrade
Upgrade
debian/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.4.1+1-1~deb13u1Fixed in 25.0.4.1+1-1Fixed in 25.0.5~6ea-1 - Upgrade
Upgrade
debian/openjdk-26to a version that resolves this vulnerability.Fixed in 26.0.2.1+1-1 - Upgrade
Upgrade
debian/openjdk-8to a version that resolves this vulnerability.Fixed in 8u504-ga-1
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
Deployments using the affected Oracle Java SE, Oracle GraalVM for JDK, or Oracle GraalVM Enterprise Edition versions are exposed when they process attacker-supplied data through JSSE APIs over TLS, such as through a web service. The issue does not require untrusted Java Web Start applications or untrusted Java applets.
What does an attacker need to exploit it?
An unauthenticated attacker needs network access via TLS and must be able to supply data to the affected JSSE APIs. No user interaction or attacker privileges are required.
What is the expected impact of successful exploitation?
Successful exploitation can cause a partial denial of service affecting the vulnerable Java or GraalVM deployment. The provided CVSS vector indicates no confidentiality or integrity impact.
Which versions are identified as affected?
Affected Oracle Java SE versions are 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, and 26.0.2. Affected Oracle GraalVM for JDK versions are 17.0.20 and 21.0.12, and the affected Oracle GraalVM Enterprise Edition version is 21.3.19.