Vulnerability in the Oracle Java SE compiler component allows an unauthenticated attacker with network access to supply crafted data to APIs, leading to a hang or repeatable crash that causes a complete denial of service. The flaw is classified as an improper access control vulnerability (CWE-284) and was rated with a CVSS 3.1 base score of 5.9, indicating moderate severity. Availability is the sole impact, with no known confidentiality or integrity compromise.

Oracle Corporation Oracle Java SE version 26.0.2 is affected. No other versions are listed as vulnerable.

The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates that the vulnerability can be exploited over any network, requires no privileges or user interaction, and has a high attack complexity, reflecting the difficulty of exploitation. The EPSS score of 0.00351 indicates a very low exploitation probability and the vulnerability is not listed in the CISA KEV catalog, suggesting limited or no known active exploitation. Nevertheless, the impact is a service outage, and systems running this product should evaluate exposure and adopt mitigations promptly relative to the moderate severity.