Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition Networking denial of service

Summaryinfo

A vulnerability categorized as problematic has been discovered in Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition. Affected is an unknown function of the component Networking. The manipulation results in denial of service. This vulnerability is reported as CVE-2026-34282. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition (affected version unknown). Affected is an unknown functionality of the component Networking. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability. CVE summarizes:

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

The advisory is shared for download at oracle.com. This vulnerability is traded as CVE-2026-34282 since 03/26/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/12/2026). The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability scanner Nessus provides a plugin with the ID 309659 (RHEL 7 / 8 / 9 : Java 11 OpenJDK ELS Security Update (Important) (RHSA-2026:9254)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (309659) and CERT Bund (WID-SEC-2026-1201). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Debian Linux
• IBM Tivoli Monitoring
• Amazon Linux 2
• Open Source OpenJDK
• Red Hat Enterprise Linux
• Ubuntu Linux
• IBM WebSphere Application Server
• SUSE Linux
• IBM Tivoli Netcool/OMNIbus
• Oracle Linux
• IBM Rational Software Architect
• IBM TXSeries
• IBM InfoSphere Information Server
• IBM Content Manager
• SUSE openSUSE
• RESF Rocky Linux
• NetApp ActiveIQ Unified Manager
• Azul Zulu
• IBM Semeru Runtime
• Open Source Camunda
• IBM App Connect Enterprise
• Oracle Java SE
• Oracle GraalVM
• IBM Java
• IBM Business Automation Workflow
• RealObjects PDFreactor
• IBM Rational Application Developer for WebSphere Software
• IBM WebSphere Service Registry and Repository
• IBM Tivoli Network Manager

Productinfo

Type

• Programming Language Software

Vendor

• Oracle

Name

• GraalVM Enterprise Edition
• GraalVM for JDK
• Java SE

License

• open-source

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion