A vulnerability in the Libraries component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows an unauthenticated attacker who has network access to exploit APIs available through multiple protocols. Successful exploitation can cause a partial denial of service, disrupting application availability but not compromising confidentiality or integrity. The weakness is similar to a resource exhaustion or availability control failure, as it is broadly described as "partial DOS" based on usage of vulnerable APIs.

Affected vendors include Oracle Corporation. The vulnerable products are Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Versions that can be compromised are Java SE 8u481, 8u481‑b50, 8u481‑perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, and 26; GraalVM for JDK 17.0.18 and 21.0.10; and GraalVM Enterprise Edition 21.3.17.

The CVSS score of 3.7 indicates a low‑to‑moderate severity. The attack vector is Network, with high attack complexity, no prerequisites, and no user interaction required. The EPSS score of 0.00047 indicates a very low exploitation probability (<1%), and the vulnerability is not listed in the CISA KEV catalog. The vulnerability can be triggered without authentication and across multiple protocols, which may still allow exploitation for organizations that expose Java services to the internet. If exploited, an attacker can disrupt services, potentially affecting end‑users or downstream systems that rely on the affected Java components.