This vulnerability (CVE-2026-70907) affects the JSSE component in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It allows an unauthenticated attacker with network access via TLS to cause a partial denial of service (availability impact). The affected versions include Oracle Java SE 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK 17.0.20 and 21.0.12; and Oracle GraalVM Enterprise Edition 21.3.19. Exploitation requires supplying data to the JSSE APIs without using untrusted Java Web Start applications or applets. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L with a base score of 5.3. Oracle has published a Critical Security Patch Update including fixes for this vulnerability and strongly recommends applying patches without delay.

Successful exploitation of this vulnerability can cause a partial denial of service (availability impact) on affected Oracle Java SE and GraalVM products. There is no impact on confidentiality or integrity. The attack can be performed by an unauthenticated attacker with network access via TLS. No known exploits in the wild have been reported.

Oracle has released security patches for this vulnerability as part of their August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Remaining on actively-supported versions and timely patching are critical. No additional mitigations are specified beyond applying the official patches.