CVE-2026-83378: Medium severity Oracle Java SE vulnerability
Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openjdk-21to a version that resolves this vulnerability.Fixed in 21.0.13+9-1~deb13u2 - Upgrade
Upgrade
debian/openjdk-21to a version that resolves this vulnerability.Fixed in 21.0.13+9-1 - Upgrade
Upgrade
debian/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5+8-1~deb13u1 - Upgrade
Upgrade
debian/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5+8-1 - Upgrade
Upgrade
alpine/openjdk17to a version that resolves this vulnerability.Fixed in 17.0.21.0.3_p1-r0 - Upgrade
Upgrade
alpine/openjdk21to a version that resolves this vulnerability.Fixed in 21.0.13.0.3_p1-r0 - Upgrade
Upgrade
alpine/openjdk25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3_p1-r0 - Upgrade
Upgrade
debian/openjdk-21to a version that resolves this vulnerability.Fixed in 21.0.13+9-1~deb13u2Fixed in 21.0.13.0.3+1-1 - Upgrade
Upgrade
debian/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5+8-1~deb13u1Fixed in 25.0.5+8-1Fixed in 25.0.5.0.3+1-1 - Upgrade
Upgrade
debian/openjdk-27to a version that resolves this vulnerability.Fixed in 27.0.1.0.3+1-1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~22.04.1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~24.04.1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~26.10.1 - Upgrade
Upgrade
ubuntu/openjdk-27to a version that resolves this vulnerability.Fixed in 27.0.1.0.3+1-1~26.10.1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~26.04.1
Event History
Frequently Asked Questions
What attack path is required to exploit this issue?
An unauthenticated attacker needs network access and must be able to supply data to affected Compiler component APIs, for example through a web service. Oracle characterizes exploitation as difficult, reflected by the high attack-complexity rating.
Are Java Web Start applications or Java applets an exploitation path?
No. The issue can be exploited without using untrusted Java Web Start applications or untrusted Java applets; the relevant path is supplying data to APIs in the affected component.
What could a successful attacker access or change?
Successful exploitation can permit unauthorized read access to a subset of accessible Oracle Java SE data and unauthorized update, insertion, or deletion of some accessible data. The CVSS assessment indicates low confidentiality and integrity impact, with no availability impact.