Oracle Java SE/GraalVM Enterprise Edition Hotspot denial of service

Summaryinfo

A vulnerability marked as problematic has been reported in Oracle Java SE and GraalVM Enterprise Edition. This affects an unknown part of the component Hotspot. Performing a manipulation results in denial of service. This vulnerability is known as CVE-2026-22003. Attacking locally is a requirement. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Oracle Java SE and GraalVM Enterprise Edition (the affected version is unknown). This affects an unknown code of the component Hotspot. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on integrity, and availability. The summary by CVE is:

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u481 and 8u481-b50; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 6.0 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H).

It is possible to read the advisory at oracle.com. This vulnerability is uniquely identified as CVE-2026-22003 since 01/05/2026. The exploitability is told to be difficult. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-1201). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Debian Linux
• IBM Tivoli Monitoring
• Amazon Linux 2
• Open Source OpenJDK
• Red Hat Enterprise Linux
• Ubuntu Linux
• IBM WebSphere Application Server
• SUSE Linux
• IBM Tivoli Netcool/OMNIbus
• Oracle Linux
• IBM Rational Software Architect
• IBM TXSeries
• IBM InfoSphere Information Server
• IBM Content Manager
• SUSE openSUSE
• RESF Rocky Linux
• NetApp ActiveIQ Unified Manager
• Azul Zulu
• IBM Semeru Runtime
• Open Source Camunda
• IBM App Connect Enterprise
• Oracle Java SE
• Oracle GraalVM
• IBM Java
• IBM Business Automation Workflow
• RealObjects PDFreactor
• IBM Rational Application Developer for WebSphere Software
• IBM WebSphere Service Registry and Repository
• IBM Tivoli Network Manager

Productinfo

Type

• Programming Language Software

Vendor

• Oracle

Name

• GraalVM Enterprise Edition
• Java SE

License

• open-source

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion