CVE-2026-87291: Medium severity Oracle Java SE vulnerability
Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openjdk-21to a version that resolves this vulnerability.Fixed in 21.0.13+9-1~deb13u2 - Upgrade
Upgrade
debian/openjdk-21to a version that resolves this vulnerability.Fixed in 21.0.13+9-1 - Upgrade
Upgrade
debian/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5+8-1~deb13u1 - Upgrade
Upgrade
debian/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5+8-1 - Upgrade
Upgrade
alpine/openjdk17to a version that resolves this vulnerability.Fixed in 17.0.21.0.3_p1-r0 - Upgrade
Upgrade
alpine/openjdk21to a version that resolves this vulnerability.Fixed in 21.0.13.0.3_p1-r0 - Upgrade
Upgrade
alpine/openjdk25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3_p1-r0 - Upgrade
Upgrade
debian/openjdk-21to a version that resolves this vulnerability.Fixed in 21.0.13+9-1~deb13u2Fixed in 21.0.13.0.3+1-1 - Upgrade
Upgrade
debian/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5+8-1~deb13u1Fixed in 25.0.5+8-1Fixed in 25.0.5.0.3+1-1 - Upgrade
Upgrade
debian/openjdk-27to a version that resolves this vulnerability.Fixed in 27.0.1.0.3+1-1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~22.04.1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~24.04.1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~26.10.1 - Upgrade
Upgrade
ubuntu/openjdk-27to a version that resolves this vulnerability.Fixed in 27.0.1.0.3+1-1~26.10.1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~26.04.1
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Deployments using Oracle Java SE 21.0.12.1, 25.0.4.1, or 27 are affected when an unauthenticated network attacker can supply data to Networking component APIs, including through a web service. The issue does not require untrusted Java Web Start applications or untrusted Java applets.
What does an attacker need to exploit it?
An attacker needs network access and the ability to provide crafted data to APIs in the Oracle Java SE Networking component through one of multiple protocols. No authentication or user interaction is required.
What is the likely impact of successful exploitation?
Successful exploitation can allow unauthorized read access to a subset of data accessible to the affected Oracle Java SE installation. The stated impact is limited to confidentiality; integrity and availability impacts are not indicated.