It was discovered that the implementation of multiple classes in the Serialization component of OpenJDK did not limit the amount of memory allocated when creating object instances from a serialized form. A specially-crafted input could cause a Java application to use an excessive amount of memory when deserialized.

It was found that the HttpURLConnection and HttpsURLConnection classes implementations in the Networking component of OpenJDK failed to check for newline characters embedded in URLs. An attacker able to make a Java application to perform an HTTP request to an attacker provided URL could possibly inject additional headers into the request.

An unspecified vulnerability in Oracle Java SE related to the Java SE, Java SE Embedded, JRockit Networking component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.