CVE-2026-91417: Medium severity Oracle Java SE vulnerability
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/openjdk17to a version that resolves this vulnerability.Fixed in 17.0.21.0.3_p1-r0 - Upgrade
Upgrade
alpine/openjdk21to a version that resolves this vulnerability.Fixed in 21.0.13.0.3_p1-r0 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~16.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~18.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~20.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~22.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~24.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~26.04.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected releases are Oracle Java SE 8u503 and 8u503-perf, and Oracle GraalVM Enterprise Edition 21.3.19.1.1. Exposure requires an application to accept attacker-controlled data through APIs in the CORBA component, such as through a web service.
Does exploitation require authentication, user interaction, or untrusted Java Web Start or applet content?
No authentication or user interaction is required, and the issue is reachable over the network using multiple protocols. The vulnerability is specifically described as exploitable without using untrusted Java Web Start applications or untrusted Java applets.
What is the expected impact if exploitation succeeds?
Successful exploitation can cause a partial denial of service affecting Oracle Java SE or Oracle GraalVM Enterprise Edition. The stated CVSS impacts are limited to availability; confidentiality and integrity impacts are none.