Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition JSSE denial of service

Summaryinfo

A vulnerability, which was classified as problematic, was found in Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition. This impacts an unknown function of the component JSSE. The manipulation results in denial of service. This vulnerability is identified as CVE-2026-70907. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition (affected version not known). Affected is some unknown functionality of the component JSSE. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability. CVE summarizes:

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

The advisory is shared for download at oracle.com. This vulnerability is traded as CVE-2026-70907 since 08/05/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/19/2026). The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability scanner Nessus provides a plugin with the ID 338214 (RHEL 8 / 9 : java-1.8.0-openjdk (RHSA-2026:55775)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (338214) and CERT Bund (WID-SEC-2026-2897). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• IBM Java
• IBM AIX
• IBM VIOS
• Debian Linux
• IBM WebSphere Service Registry and Repository
• Amazon Linux 2
• IBM Tivoli Business Service Manager
• Open Source OpenJDK
• Red Hat Enterprise Linux
• IBM Tivoli Netcool/OMNIbus
• IBM Tivoli Monitoring
• Azul Zulu
• IBM Rational ClearQuest
• IBM Integration Bus
• IBM WebSphere Application Server
• IBM InfoSphere Information Server
• RESF Rocky Linux
• SUSE Linux
• SUSE openSUSE
• Ubuntu Linux
• Oracle Linux
• IBM WebSphere Application Server Liberty
• Oracle Java SE
• Oracle GraalVM
• Amazon Corretto
• IBM App Connect Enterprise
• IBM Semeru Runtime
• IBM Security Verify Access

Productinfo

Type

• Programming Language Software

Vendor

• Oracle

Name

• GraalVM Enterprise Edition
• GraalVM for JDK
• Java SE

License

• open-source

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion