CVE-2026-91453 in Java SE
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Lightweight HTTP Server component of Oracle Java SE, as well as Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. This security flaw affects a specific set of supported versions including Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 25.0.4.1, alongside GraalVM versions 17.0.20.1, 21.0.12.1, and Enterprise Edition 21.3.19.1.1. The Lightweight HTTP Server is a utility often used for embedded applications or internal services where full-scale application servers are unnecessary. However, its implementation in these Oracle products contains a critical flaw that allows unauthenticated attackers to compromise the integrity of accessible data through network access via multiple protocols.
The technical nature of this vulnerability centers on an easily exploitable condition that permits unauthorized modifications to data managed by the Lightweight HTTP Server. Specifically, successful exploitation enables an attacker to perform unauthorized update, insert, or delete operations against data accessible through the component's APIs. This indicates a failure in input validation or access control mechanisms within the server logic, allowing external inputs to directly manipulate underlying storage structures without proper authentication checks. The vulnerability is classified under CWE-20 Improper Input Validation and aligns with MITRE ATT&CK technique T1564.008 Hidden Files and Directories if it involves data manipulation that obscures system state, though primarily it represents a direct integrity violation through API abuse.
The operational impact of this vulnerability is significant due to its low barrier for exploitation. The CVSS 3.1 base score of 5.3 reflects medium severity with a primary focus on Integrity impacts rather than Confidentiality or Availability. The vector string AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N confirms that the attack requires no user interaction, has low complexity, and does not require prior authentication. An attacker can initiate an exploit remotely over any network protocol supported by the HTTP server component. This means that if the Lightweight HTTP Server is exposed to a network, even one behind a firewall but with specific ports open for internal services, it becomes a viable target for automated scanning tools seeking to inject malicious data or corrupt existing records.
It is crucial to note the specific constraints on exploitation methods outlined in the advisory. The vulnerability can only be exploited by supplying data directly to APIs within the specified component. It cannot be triggered through Untrusted Java Web Start applications or Untrusted Java applets, which were historically common vectors for Java-based exploits but are now largely deprecated and restricted. This limitation suggests that the attack surface is narrower than typical web application vulnerabilities, focusing instead on programmatic API consumption. Attackers must interact directly with the server endpoints rather than relying on client-side execution contexts like browsers or legacy plugin environments.
Mitigation strategies should prioritize immediate patching to the latest available versions of Oracle Java SE and GraalVM that address this specific flaw in the Lightweight HTTP Server component. Organizations running these components internally should review their network segmentation policies to ensure that such services are not unnecessarily exposed to untrusted networks. If exposure is required, implementing strict access control lists at the network level or using reverse proxies with authentication requirements can provide a compensating control until patches are applied. Additionally, developers utilizing this API should implement additional input validation and sanitization layers in their application code as an extra defense-in-depth measure against potential data manipulation attempts.