CVE-2026-91373 in GraalVM Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Java Secure Socket Extension, commonly referred to as JSSE, which is a core component of Oracle Java SE responsible for implementing secure network protocols such as TLS and SSL. This flaw affects multiple supported versions including Oracle Java SE releases 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 25.0.4.1, as well as specific builds of Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. The nature of this vulnerability is characterized by its ease of exploitation, allowing an unauthenticated attacker to leverage network access via the TLS protocol to compromise the integrity or availability of the Java runtime environment. Because JSSE handles the cryptographic operations and handshake processes essential for secure communications, flaws within this module can have significant implications for any application relying on it for encrypted data transmission.
The operational impact of this vulnerability is primarily centered around availability rather than confidentiality or integrity in the traditional sense of data theft or modification. Successful exploitation enables an attacker to cause a partial denial of service against Oracle Java SE applications. This means that while the system may not be completely taken offline, its ability to process legitimate requests can be severely degraded through resource exhaustion or state corruption triggered by malformed TLS interactions. The vulnerability is particularly relevant for deployments where untrusted code is executed within the Java sandbox, such as clients running sandboxed Java Web Start applications or applets that load and run code from the internet. In these scenarios, the application relies heavily on the security boundaries provided by the JSSE component to ensure safe communication with remote servers, making them susceptible if those underlying mechanisms are flawed.
From a technical classification perspective, this issue aligns with CWE-400, which covers uncontrolled resource consumption leading to denial of service conditions. The attack vector is classified as network-based with low complexity and requires no user interaction or authentication, reflecting the CVSS 3.1 base score of 5.3 which indicates a medium severity level driven by availability impacts. In terms of adversary tactics, this vulnerability can be leveraged within the MITRE ATT&CK framework under techniques related to resource hijacking or service disruption, specifically targeting the communication layer to degrade system performance without necessarily exfiltrating data. Attackers could potentially craft specific TLS handshake messages or malformed certificate chains that trigger inefficient processing loops or memory leaks within the JSSE implementation, thereby consuming excessive CPU cycles or heap space until the application becomes unresponsive.
Mitigation strategies for this vulnerability primarily involve applying the latest security patches provided by Oracle to update the affected Java SE and GraalVM versions to their respective secure builds. Organizations should prioritize updating environments where Java applications are exposed to network traffic via TLS, especially those involving web services or client-side applets that process external data inputs. Additionally, implementing strict input validation at the application layer can provide a secondary defense mechanism by filtering out potentially malicious payloads before they reach the JSSE component. Security teams should also monitor for unusual spikes in resource usage associated with TLS connections and consider deploying network-level protections such as rate limiting or deep packet inspection to detect and block anomalous traffic patterns that may indicate exploitation attempts against this specific flaw.