CVE-2026-91381: Low severity Oracle Java SE vulnerability
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/openjdk21to a version that resolves this vulnerability.Fixed in 21.0.13.0.3_p1-r0 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~16.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~18.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~20.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~22.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~24.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~26.04.1
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
The issue applies to affected Oracle Java SE and Oracle GraalVM Enterprise Edition deployments where untrusted data can reach the Java 2D APIs, such as through a web service. It also applies to client deployments that run sandboxed Java Web Start applications or sandboxed Java applets containing untrusted code and rely on the Java sandbox.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction and can have network access through multiple protocols. Exploitation is described as difficult and may be performed by supplying data to APIs in the affected component.
What is the potential impact of successful exploitation?
Successful exploitation can allow unauthorized update, insertion, or deletion of some data accessible to the affected Java SE or GraalVM Enterprise Edition deployment. The stated impact is limited to integrity; no confidentiality or availability impact is listed.
Which versions are identified as affected?
Affected Oracle Java SE versions are 8u503 and 8u503-perf. The affected Oracle GraalVM Enterprise Edition version is 21.3.19.1.1.