Search: CVE-2026-22021

CVE-2026-22021 is a medium severity vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition affecting the JSSE component. It allows an unauthenticated attacker with network access via HTTPS to cause a partial denial of service (DoS) condition. The vulnerability impacts multiple supported versions of these products. Exploitation can occur through APIs, such as web services supplying data to the affected component, including sandboxed Java Web Start applications or applets running untrusted code. The CVSS 3.1 base score is 5.3, reflecting an availability impact without confidentiality or integrity compromise. Oracle has published a Critical Patch Update advisory that includes patches for numerous vulnerabilities but does not explicitly confirm patch availability or remediation status for this specific CVE. Customers are strongly advised to apply Oracle Critical Patch Updates promptly to mitigate known vulnerabilities.