This vulnerability affects Oracle Java SE (versions 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1), Oracle GraalVM for JDK (17.0.19, 21.0.11), and Oracle GraalVM Enterprise Edition (21.3.18). It resides in the 2D component and can be exploited by unauthenticated attackers with network access via multiple protocols to cause a partial denial of service. Exploitation can occur through APIs, such as web services that supply data to the vulnerable component, and also applies to sandboxed Java Web Start applications or applets running untrusted code. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, and low availability impact.

Successful exploitation results in unauthorized ability to cause a partial denial of service (partial DOS) affecting availability of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Oracle Critical Patch Update Advisory for July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) should be monitored for patches addressing this vulnerability. Oracle strongly recommends applying security patches promptly and remaining on actively-supported versions. No specific temporary mitigations or workarounds are provided in the advisory.