CVE-2026-91417
Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in Oracle Java SE

Publication date: 2026-10-20

Last updated on: 2026-10-22

Assigner: Oracle

Description
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-22
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-08
NVD
CVE-2026-91417
EUVD
EUVD-2026-106668

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in Oracle Java SE and Oracle GraalVM Enterprise Edition affecting versions 8u503, 8u503-perf, and 21.3.19.1.1. It allows unauthenticated attackers to cause a partial denial of service (DOS) via network access without needing user interaction or privileged access.

Detection Guidance

Detection of this vulnerability requires checking for affected versions of Oracle Java SE or GraalVM Enterprise Edition. Use commands like 'java -version' or 'gu -version' to verify installed versions. Ensure systems are updated to versions beyond 8u503 or 21.3.19.1.1.

Impact Analysis

The vulnerability can lead to disruptions in Java applications using the affected components, causing reduced availability or performance issues. It does not allow data theft or code execution but may impact services relying on Java SE or GraalVM.

Compliance Impact

This vulnerability causes a partial denial of service (DOS) in Oracle Java SE and GraalVM Enterprise Edition. While it does not directly impact data confidentiality or integrity, a DOS condition could disrupt system availability, which may affect compliance with regulations like GDPR (data processing continuity) or HIPAA (system availability for healthcare operations). However, specific compliance impacts depend on system configuration and use case.

Mitigation Strategies

Update Oracle Java SE to a version that is not affected by this vulnerability. Specifically, upgrade to a version later than 8u503 and 8u503-perf for Oracle Java SE, and 21.3.19.1.1 for Oracle GraalVM Enterprise Edition.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91417. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...