Description
Vulnerability in Oracle Java SE (component: Networking). The supported version that is affected is Oracle Java SE: 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
Published: 2026-10-20
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: Partial Denial of Service (Availability)
Action: Apply Patch
AI Analysis

Impact

A flaw in the networking component of Oracle Java SE 27 allows an unauthenticated attacker with network access to trigger a partial denial of service. The vulnerability is exploited through multiple network protocols and can be activated via APIs used by web services or sandboxed Java clients that load untrusted code. Successful exploitation results in a loss of availability for the Java runtime, potentially disrupting applications that rely on Java.

Affected Systems

Oracle Enterprise customers using Java SE 27, especially those employing the networking API in server or client environments, are impacted. The flaw also applies to Java Web Start applications and sandboxed Java applets that rely on the Java sandbox to guard against untrusted code.

Risk and Exploitability

The CVSS v3.1 base score of 3.7 indicates a low severity loss of availability. The EPSS score of < 1% signals a very low probability of observed exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must be able to reach the Java process over the network, but authentication is not required. Exploitation requires multiple protocols and is considered difficult, so the overall risk is moderate with a low likelihood of exploitation under current conditions.

Generated by OpenCVE AI on October 23, 2026 at 21:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Oracle Java SE 27 to the latest patched version that addresses the networking component flaw
  • If an update cannot be applied immediately, restrict the Java application’s exposure to untrusted network traffic and disable any external APIs that can trigger the vulnerable component
  • Implement any temporary configuration changes recommended by Oracle to limit the use of network protocols by Java applications until a patch is available

Generated by OpenCVE AI on October 23, 2026 at 21:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-730

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title Oracle Java SE 27 Denial of Service via Networking Component openjdk: Enhance QUIC connections (Oracle CPU 2026-10)
Weaknesses CWE-770
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Oracle oracle Java Se
Vendors & Products Oracle oracle Java Se

Wed, 21 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Title Oracle Java SE 27 Denial of Service via Networking Component
Weaknesses CWE-730

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle Java SE (component: Networking). The supported version that is affected is Oracle Java SE: 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
First Time appeared Oracle
Oracle java Se
CPEs cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle java Se
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Oracle Java Se Oracle Java Se
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-23T19:56:25.258Z

Reserved: 2026-09-14T22:10:16.633Z

Link: CVE-2026-91409

cve-icon Vulnrichment

Updated: 2026-10-23T19:56:19.331Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:44.260

Modified: 2026-10-23T20:17:29.230

Link: CVE-2026-91409

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-20T21:25:48Z

Links: CVE-2026-91409 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T22:00:28Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling