The vulnerability resides in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition’s networking component, specifically the handling of HTTP requests. It allows an unauthenticated attacker with network access to craft malicious requests that can lead to unauthorized update, insert, delete, or read operations on data accessible to the affected JVM. This is a CWE‑93 weakness in HTTP request parsing that permits improper handling of malformed input. The attack requires user interaction with a system that processes the request, limiting the risk to environments where the JVM exposes services that accept external input.

Systems that run Oracle Java SE versions 8u471, 8u471‑b50, 8u471‑perf, 11.0.29, 17.0.17, 21.0.9, or 25.0.1, as well as Oracle GraalVM for JDK 17.0.17 and 21.0.9 and Oracle GraalVM Enterprise Edition 21.3.16, are affected. The listed CPEs also include Red‑Hat Enterprise Linux OpenJDK ELS 11 distributions on el7‑9, reflecting that any Java runtime employing the vulnerable networking APIs is at risk. Additional Java applications that rely on sandboxed Java Web Start or applets could also be impacted if they load untrusted code over the network.

The CVSS base score of 6.1 classifies the issue as moderate, with moderate confidentiality and integrity impact. However, the EPSS score is below 1% and the vulnerability is not present in the CISA KEV catalog, indicating a very low current exploitation likelihood. The requirement for user interaction and network exposure confines potential attacks to environments where an attacker can entice a user to send a crafted request or where vulnerable services are exposed to hostile traffic. Consequently, while the exposed data could be altered or disclosed, the practical risk is mitigated by the low probability of exploitation and the need for a cooperating user.