Junglewise Threat Intelligence

CVE-2026-34282: Oracle Java SE and GraalVM denial of service in Networking component

CVE-2026-34282 · Severity: high · CVSS 7.5 · Published 2026-04-21

Technologies: Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle Graalvm For Jdk. Vendors: Oracle, Red Hat.

Executive brief

A vulnerability exists in the networking component of Oracle Java and GraalVM, which are widely used platforms for running enterprise applications and web services. An attacker can exploit this flaw over a network to cause the application to hang or crash repeatedly, leading to a complete denial of service. This could disrupt business operations, take critical web services offline, and impact the availability of customer-facing applications.

Technical details

This vulnerability is classified as an uncontrolled resource consumption or infinite loop (CWE-400, CWE-835) within the Networking component of the Java runtime. It is easily exploitable by an unauthenticated attacker with network access via multiple protocols, typically by providing malicious data to APIs used by web services or sandboxed applications (Java Web Start/applets). A successful exploit results in a complete denial of service (DoS) by causing the JVM to hang or crash. The issue affects various versions of Oracle Java SE, GraalVM, and Red Hat OpenJDK, and has been addressed in subsequent CPU (Critical Patch Update) releases such as OpenJDK 25.0.3.

Affected products

  • Oracle Java SE 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26
  • Oracle GraalVM for JDK 17.0.18, 21.0.10
  • Oracle GraalVM Enterprise Edition 21.3.17
  • Red Hat OpenJDK 11, 21, 25.0.2

Timeline

  • 2026-04-21: advisory: Initial disclosure by Oracle/NVD
  • 2026-04-28: patched: Red Hat released security updates for hardened images
  • 2026-04-30: patched: Red Hat released OpenJDK 25.0.3 security update for Windows

References

Related threats