This vulnerability affects Oracle Java SE and Oracle GraalVM products in their specified versions, involving the Libraries component. An unauthenticated attacker with network access can exploit APIs to cause a partial denial of service. The vulnerability is difficult to exploit and does not affect confidentiality or integrity. It also applies to Java deployments running sandboxed untrusted code. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, reflecting network attack vector, high attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, and low availability impact. Oracle's April 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation details for it. No known exploits in the wild have been reported.

Successful exploitation can result in unauthorized partial denial of service affecting availability of Oracle Java SE and GraalVM products. There is no impact on confidentiality or integrity. The vulnerability is difficult to exploit and requires network access with high attack complexity. No known active exploitation has been reported.

Oracle's April 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly confirm a specific patch or remediation level for CVE-2026-22018. Customers are strongly advised to apply the April 2026 Critical Patch Update promptly to address this and other vulnerabilities. Patch status is not yet confirmed specifically for this CVE—check the Oracle advisory at https://www.oracle.com/security-alerts/cpuapr2026.html for the latest remediation guidance. No vendor advisory states that no action is required or that the issue is already mitigated.