The Lightweight HTTP Server component in Oracle Java SE, along with its GraalVM derivatives, contains an improper header handling flaw (CWE-444). An unauthenticated attacker can supply malicious input to exposed APIs over the network and gain the ability to perform update, insert or delete operations on data that the server exposes, thereby compromising data integrity while leaving confidentiality and availability untouched. The CVSS 3.1 base score of 5.3 indicates a medium severity condition that requires no privileges, no user interaction, and occurs over a network connection.

Affected products include Oracle GraalVM Enterprise Edition 21.3.19.1.1, Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1, and Oracle Java SE releases 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27. All of these versions run a Lightweight HTTP Server component that is vulnerable.

The CVSS base score of 5.3 denotes a medium severity vulnerability. The EPSS score of < 1% indicates that active exploitation is currently unlikely, but the lack of authentication and the network-based attack vector mean that, once a patch is available, the vulnerability could be leveraged by adversaries. The vulnerability is not listed in the CISA KEV catalog, so no confirmed exploitation has been reported. Nevertheless, because the flaw permits modification of exposed data, it should be addressed as soon as possible; the low EPSS value does not negate the need for prompt remediation.