UBUNTU-CVE-2026-83381: Medium severity ubuntu/openjdk-8 vulnerability
Vulnerability in Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~16.04.1 - Upgrade
Upgrade
ubuntu/openjdk-ltsto a version that resolves this vulnerability.Fixed in 11.0.33+9-1ubuntu1~18.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~18.04.1 - Upgrade
Upgrade
ubuntu/openjdk-ltsto a version that resolves this vulnerability.Fixed in 11.0.33+9-1ubuntu1~20.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~20.04.1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~22.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~22.04.1 - Upgrade
Upgrade
ubuntu/openjdk-ltsto a version that resolves this vulnerability.Fixed in 11.0.33+9-1ubuntu1~22.04.1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~24.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~24.04.1 - Upgrade
Upgrade
ubuntu/openjdk-ltsto a version that resolves this vulnerability.Fixed in 11.0.33+9-1ubuntu1~24.04.1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~26.10.1 - Upgrade
Upgrade
ubuntu/openjdk-27to a version that resolves this vulnerability.Fixed in 27.0.1.0.3+1-1~26.10.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/openjdk-ltsto a version that resolves this vulnerability.Fixed in 11.0.33+9-1ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~26.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~26.04.1 - Upgrade
Upgrade
ubuntu/openjdk-ltsto a version that resolves this vulnerability.Fixed in 11.0.33+9-1ubuntu1~26.04.1
Event History
Frequently Asked Questions
Which deployments are most relevant to this issue?
The issue is relevant to applications that expose or feed data into the affected Security component APIs, including through web services. It also applies to client deployments that run sandboxed Java Web Start applications or sandboxed Java applets loading untrusted internet-sourced code and relying on the Java sandbox.
What access does an attacker need to attempt exploitation?
An attacker does not need authentication or user interaction, but must have network access through multiple protocols. Exploitation is described as difficult and may involve supplying data to the affected APIs.
What could a successful attack allow?
A successful attack may provide unauthorized read access to a subset of accessible Oracle Java SE data. It may also allow unauthorized update, insert, or delete operations on some accessible data; no availability impact is stated.