Log in Start free

Vulnerability · Published Oct 20, 2026 · Assigned by oracle

CVE-2026-91417

Medium 5.3

In plain English

A medium-severity uncontrolled resource consumption in Oracle GraalVM Enterprise Edition from Oracle Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 76.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23openjdk1717.0.21.0.3_p1-r0ALPINE-CVE-2026-91417
Alpine:v3.24openjdk1717.0.21.0.3_p1-r0ALPINE-CVE-2026-91417
Alpine:v3.23openjdk2121.0.13.0.3_p1-r0ALPINE-CVE-2026-91417
Alpine:v3.24openjdk2121.0.13.0.3_p1-r0ALPINE-CVE-2026-91417
Ubuntu:22.04:LTSopenjdk-17no fix listedUBUNTU-CVE-2026-91417
Ubuntu:24.04:LTSopenjdk-17no fix listedUBUNTU-CVE-2026-91417
Ubuntu:26.04:LTSopenjdk-17no fix listedUBUNTU-CVE-2026-91417
Ubuntu:26.10openjdk-17no fix listedUBUNTU-CVE-2026-91417
Ubuntu:26.04:LTSopenjdk-17-cracno fix listedUBUNTU-CVE-2026-91417
Ubuntu:26.10openjdk-17-cracno fix listedUBUNTU-CVE-2026-91417
Ubuntu:22.04:LTSopenjdk-18no fix listedUBUNTU-CVE-2026-91417
Ubuntu:22.04:LTSopenjdk-21no fix listedUBUNTU-CVE-2026-91417
Ubuntu:24.04:LTSopenjdk-21no fix listedUBUNTU-CVE-2026-91417
Ubuntu:26.04:LTSopenjdk-21no fix listedUBUNTU-CVE-2026-91417
Ubuntu:26.10openjdk-21no fix listedUBUNTU-CVE-2026-91417
Ubuntu:26.04:LTSopenjdk-21-cracno fix listedUBUNTU-CVE-2026-91417
Ubuntu:26.10openjdk-21-cracno fix listedUBUNTU-CVE-2026-91417
Ubuntu:22.04:LTSopenjdk-25no fix listedUBUNTU-CVE-2026-91417
Ubuntu:24.04:LTSopenjdk-25no fix listedUBUNTU-CVE-2026-91417
Ubuntu:26.04:LTSopenjdk-25no fix listedUBUNTU-CVE-2026-91417
Ubuntu:26.10openjdk-25no fix listedUBUNTU-CVE-2026-91417
Ubuntu:22.04:LTSopenjdk-8no fix listedUBUNTU-CVE-2026-91417
Ubuntu:24.04:LTSopenjdk-8no fix listedUBUNTU-CVE-2026-91417
Ubuntu:26.04:LTSopenjdk-8no fix listedUBUNTU-CVE-2026-91417
Ubuntu:26.10openjdk-8no fix listedUBUNTU-CVE-2026-91417
Ubuntu:22.04:LTSopenjdk-ltsno fix listedUBUNTU-CVE-2026-91417
Ubuntu:26.04:LTSopenjdk-ltsno fix listedUBUNTU-CVE-2026-91417
Ubuntu:26.10openjdk-ltsno fix listedUBUNTU-CVE-2026-91417

Affected products (as reported)

VendorProductVersions
Oracle Corporation Oracle Java SE 8u5038u503-perf
Oracle Corporation Oracle GraalVM Enterprise Edition 21.3.19.1.1

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References