CVE-2026-70907
Received Received - Intake

JSSE TLS Partial Denial of Service in Oracle Java SE

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Oracle

Description
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-70907

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
oracle java_se 8u501
oracle java_se 11.0.32
oracle java_se 17.0.20
oracle java_se 21.0.12
oracle java_se 25.0.4
oracle java_se 26.0.2
oracle graalvm_for_jdk 17.0.20
oracle graalvm_for_jdk 21.0.12
oracle graalvm_enterprise_edition 21.3.19

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition affecting multiple versions. It allows an unauthenticated attacker with network access via TLS to cause a partial denial of service (DOS) in the affected products. The vulnerability is exploitable by supplying data to specific APIs without requiring untrusted Java Web Start or applets.

Detection Guidance

Detection requires checking installed Java versions. For Oracle Java SE, run: java -version. Compare output against affected versions: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2. For GraalVM, check graalvm --version and compare to 17.0.20, 21.0.12, or 21.3.19.

Impact Analysis

If you use any of the affected versions of Oracle Java SE, GraalVM for JDK, or GraalVM Enterprise Edition, an attacker could disrupt service availability by causing a partial denial of service. This may lead to degraded performance or temporary unavailability of applications relying on these components.

Mitigation Strategies

Upgrade to the latest non-vulnerable versions immediately. For Oracle Java SE, update to versions beyond 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, or 26.0.2. For GraalVM, update to versions beyond 17.0.20, 21.0.12, or 21.3.19. Apply patches from official Oracle or GraalVM sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70907. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart