Oracle Java SE is affected by a flaw in the JSSE component that allows an unauthenticated network attacker to trigger a partial denial of service. The vulnerability arises from a resource consumption weakness (CWE‑400) and an excessive resource use condition (CWE‑770). The explicit description states that an attacker with network access over TLS can cause the Java runtime to crash or become unresponsive during a handshake or data exchange. The likely attack vector is an attacker sending malformed TLS packets to the target over the network, as inferred from the mention of “network access via TLS.”

The flaw impacts Oracle Corporation’s Java SE releases 8u503, 8u503‑perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 25.0.4.1, as well as Oracle GraalVM for JDK versions 17.0.20.1 and 21.0.12.1 and the GraalVM Enterprise Edition 21.3.19.1.1. Any Java deployments that expose TLS endpoints, including sandboxed Java Web Start applications or applets that load untrusted code, are affected.

The CVSS v3.1 base score of 5.3 reflects an availability impact with no authentication or user interaction required. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known attacks. Attackers would need network reach to a Java service’s TLS endpoint and could inject crafted packets to exhaust resources, potentially causing temporary downtime. Based on the CVSS score and the low EPSS, the risk is moderate but the likelihood of exploitation is low, so patching is recommended.