Eclipse Jetty is vulnerable to a denial of service, caused by an error related to some of the production servers spiking with CPU use. A remote attacker could exploit this vulnerability to consume CPU that remains high even without any traffic.
A flaw was found in the way the ClassFileParser class implementation in the Hotspot component of OpenJDK performed validation of inner class index values. A specially-crafted class file could cause a Java virtual machine to crash when loaded.
An unspecified vulnerability in Java SE related to the JSSE component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
A flaw was found in the way the Libraries component of OpenJDK handled blacklists of untrusted certificates. Alternate certificate encodings were not considered, causing certain certificate fingerprints to not be blacklisted, possibly leading to untrusted certificates being accepted.
An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors.
An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
A flaw was found in Guava that creates temporary directories with default permissions similar to /tmp. This issue may allow local users access, possibly permitting information exposure.
Last updated 18 August 2025
An unspecified vulnerability in Java SE related to the Java SE Networking component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.
A flaw was discovered in the way the Libraries component of OpenJDK processed X.509 certificates. Values of Object Identifiers (OIDs) were "interned", possibly allowing a malicious X.509 certificate to trigger excessive memory usage in a Java application processing such certificate.
A flaw was found in the way the GssKrb5Base class in the Security component of OpenJDK validated properties of SASL messages included in Kerberos GSSAPI, omitting required token checks. An remote attacker with ability to manipulate network traffic between server and client using Kerberos GSSAPI could possibly perform message modification that would not be detected during message decoding.
A flaw was found in the what the BeanContextSupport class in the Serialization component of OpenJDK handled exceptions during deserialization. A specially-crafted input could cause a Java application to use an excessive amount of resources when deserialized.
Last updated 24 July 2024
A flaw was found in the Linux kernel. The generation of the device ID from the network RNG internal state is predictable. The highest threat from this vulnerability is to data confidentiality.
Last updated 9 September 2026
An unspecified vulnerability in Java SE related to the Networking component could allow a remote attacker to cause low integrity impacts.
An unspecified vulnerability in Java SE related to the Utility component could allow a remote attacker to cause low availability impacts.
An unspecified vulnerability in Java SE related to the Libraries component could allow a remote attacker to cause low integrity impacts.
A flaw was found in the way the Hotspot component of OpenJDK handled array accesses in case of overflow in the index computation. This flaw could lead to an access at an invalid array position, leading to an out-of-bounds read vulnerability.
A flaw was found in OpenJDK where a specially crafted long message in an Exception could lead to an application crash, resulting in a denial of service condition.
A flaw was found in the Pack200 archive format in OpenJDK. The NativeUnpack class did not properly validate the memory size when allocating a buffer, potentially leading to an excessive memory allocation and denial of service condition.
A flaw was found in the C2 compiler in the Hotspot component of OpenJDK. C2 compilation fails with "Exceeded noderegs array" due to an improper size validation and out-of-bounds array access, potentially resulting in a corruption of the JVM memory.
Upstream OpenJDK issue: https://bugs.openjdk.org/browse/JDK-8317507
A potential UTF8 size overflow vulnerability was found in OpenJDK.
Oracle CPU advisory - July 2024: https://www.oracle.com/security-alerts/cpujul2024.html#AppendixJAVA
An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause a low availability impact.
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.29 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server.
External References:
https://www.oracle.com/security-alerts/cpujul2022.html#AppendixMSQL