CVE-2026-21945
Estado: ModificadaAlta (7.5)—
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.
Leer descripción completaMostrar menos
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.97%
- Percentil entre todas las CVEs puntuadas: 61
- Fecha de la puntuación: 1/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (4)
CWE
- CWE-400
- CWE-295
Referencias
- https://www.oracle.com/security-alerts/cpujan2026.html
- https://access.redhat.com/errata/RHSA-2026:0847
- https://access.redhat.com/errata/RHSA-2026:0848
- https://access.redhat.com/errata/RHSA-2026:0895
- https://access.redhat.com/errata/RHSA-2026:0897
- https://access.redhat.com/errata/RHSA-2026:0899
- https://access.redhat.com/errata/RHSA-2026:0901
- https://access.redhat.com/errata/RHSA-2026:0927
- https://access.redhat.com/errata/RHSA-2026:0928
- https://access.redhat.com/errata/RHSA-2026:0931
- https://access.redhat.com/errata/RHSA-2026:0932
- https://access.redhat.com/errata/RHSA-2026:0933
- https://access.redhat.com/errata/RHSA-2026:1606
- https://access.redhat.com/errata/RHSA-2026:4832
- https://access.redhat.com/security/cve/CVE-2026-21945
- https://bugzilla.redhat.com/show_bug.cgi?id=2429927
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21945.json
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-21945",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-21945",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-01-21T15:04:39.899042Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "secalert_us@oracle.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
},
{
"type": "Secondary",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "secalert_us@oracle.com",
"affectedData": [
{
"vendor": "Oracle Corporation",
"product": "Oracle Java SE",
"versions": [
{
"status": "affected",
"version": "8u471"
},
{
"status": "affected",
"version": "8u471-b50"
},
{
"status": "affected",
"version": "8u471-perf"
},
{
"status": "affected",
"version": "11.0.29"
},
{
"status": "affected",
"version": "17.0.17"
},
{
"status": "affected",
"version": "21.0.9"
},
{
"status": "affected",
"version": "25.0.1"
}
]
},
{
"vendor": "Oracle Corporation",
"product": "Oracle GraalVM for JDK",
"versions": [
{
"status": "affected",
"version": "17.0.17"
},
{
"status": "affected",
"version": "21.0.9"
}
]
},
{
"vendor": "Oracle Corporation",
"product": "Oracle GraalVM Enterprise Edition",
"versions": [
{
"status": "affected",
"version": "21.3.16"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"cpes": [
"cpe:/a:redhat:openjdk_els:11"
],
"vendor": "Red Hat",
"product": "OPENJDK ELS 11.0.30",
"versions": [
{
"status": "unaffected",
"version": "openjdk-portable",
"lessThan": "*",
"versionType": "rpm"
},
{
"status": "unaffected",
"version": "openjdk-windows",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-11",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openjdk:17"
],
"vendor": "Red Hat",
"product": "Red Hat Build of OpenJDK 17.0.18",
"versions": [
{
"status": "unaffected",
"version": "openjdk-portable",
"lessThan": "*",
"versionType": "rpm"
},
{
"status": "unaffected",
"version": "openjdk-windows",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-17",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openjdk:21"
],
"vendor": "Red Hat",
"product": "Red Hat Build of OpenJDK 21.0.10",
"versions": [
{
"status": "unaffected",
"version": "openjdk-portable",
"lessThan": "*",
"versionType": "rpm"
},
{
"status": "unaffected",
"version": "openjdk-windows",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-21",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openjdk:25"
],
"vendor": "Red Hat",
"product": "Red Hat Build of OpenJDK 25.0.2",
"versions": [
{
"status": "unaffected",
"version": "openjdk-portable",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-25",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openjdk:1.8"
],
"vendor": "Red Hat",
"product": "Red Hat Build of OpenJDK 8u482",
"versions": [
{
"status": "unaffected",
"version": "openjdk-portable",
"lessThan": "*",
"versionType": "rpm"
},
{
"status": "unaffected",
"version": "openjdk-windows",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-1.8.0",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.1"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"versions": [
{
"status": "unaffected",
"version": "1:21.0.10.0.7-1.el10",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-21-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.1"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"versions": [
{
"status": "unaffected",
"version": "1:25.0.2.0.10-1.el10",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-25-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "1:21.0.10.0.7-1.el10",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-21-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"versions": [
{
"status": "unaffected",
"version": "1:1.8.0.482.b08-1.el7_9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-1.8.0-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"versions": [
{
"status": "unaffected",
"version": "1:17.0.18.0.8-1.el8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-17-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"versions": [
{
"status": "unaffected",
"version": "1:21.0.10.0.7-1.el8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-21-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"versions": [
{
"status": "unaffected",
"version": "1:1.8.0.482.b08-1.el8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-1.8.0-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::supplementary"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"versions": [
{
"status": "unaffected",
"version": "1:1.8.0.8.60-1.el8_10",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-1.8.0-ibm",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.2"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
"versions": [
{
"status": "unaffected",
"version": "1:1.8.0.482.b08-1.el8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-1.8.0-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"versions": [
{
"status": "unaffected",
"version": "1:17.0.18.0.8-1.el8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-17-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"versions": [
{
"status": "unaffected",
"version": "1:1.8.0.482.b08-1.el8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-1.8.0-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus_long_life:8.4"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"versions": [
{
"status": "unaffected",
"version": "1:17.0.18.0.8-1.el8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-17-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus_long_life:8.4"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"versions": [
{
"status": "unaffected",
"version": "1:1.8.0.482.b08-1.el8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-1.8.0-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"versions": [
{
"status": "unaffected",
"version": "1:17.0.18.0.8-1.el8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-17-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"versions": [
{
"status": "unaffected",
"version": "1:1.8.0.482.b08-1.el8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-1.8.0-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_tus:8.6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
"versions": [
{
"status": "unaffected",
"version": "1:17.0.18.0.8-1.el8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-17-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_tus:8.6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
"versions": [
{
"status": "unaffected",
"version": "1:1.8.0.482.b08-1.el8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-1.8.0-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "1:17.0.18.0.8-1.el8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-17-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "1:1.8.0.482.b08-1.el8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-1.8.0-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_tus:8.8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"versions": [
{
"status": "unaffected",
"version": "1:17.0.18.0.8-1.el8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-17-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_tus:8.8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"versions": [
{
"status": "unaffected",
"version": "1:1.8.0.482.b08-1.el8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-1.8.0-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "1:17.0.18.0.8-1.el8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-17-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "1:1.8.0.482.b08-1.el8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-1.8.0-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"versions": [
{
"status": "unaffected",
"version": "1:17.0.18.0.8-1.el9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-17-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"versions": [
{
"status": "unaffected",
"version": "1:21.0.10.0.7-1.el9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-21-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"versions": [
{
"status": "unaffected",
"version": "1:1.8.0.482.b08-1.el9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-1.8.0-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"versions": [
{
"status": "unaffected",
"version": "1:25.0.2.0.10-1.el9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-25-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.0"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "1:17.0.18.0.8-1.el9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-17-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.0"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "1:1.8.0.482.b08-1.el9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-1.8.0-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "1:17.0.18.0.8-1.el9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-17-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "1:1.8.0.482.b08-1.el9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-1.8.0-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "1:17.0.18.0.8-1.el9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-17-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "1:21.0.10.0.7-1.el9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-21-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "1:1.8.0.482.b08-1.el9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-1.8.0-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "1:17.0.18.0.8-1.el9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-17-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "1:21.0.10.0.7-1.el9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-21-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "1:1.8.0.482.b08-1.el9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-1.8.0-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openjdk_els:11::el7"
],
"vendor": "Red Hat",
"product": "Red Hat OpenJDK 11 els for RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "1:11.0.30.0.7-1.el7_9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-11-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openjdk_els:11::el8"
],
"vendor": "Red Hat",
"product": "Red Hat OpenJDK 11 els for RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "1:11.0.30.0.7-1.el8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-11-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openjdk_els:11::el9"
],
"vendor": "Red Hat",
"product": "Red Hat OpenJDK 11 els for RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "1:11.0.30.0.7-1.el9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-11-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openjdk:25"
],
"vendor": "Red Hat",
"product": "Temurin Build of OpenJDK 25.0.2",
"versions": [
{
"status": "unaffected",
"version": "openjdk-windows",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "java-25",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"packageName": "java-21-ibm-semeru-certified-jdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"packageName": "java-1.6.0-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"packageName": "java-1.7.0-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"packageName": "java-1.8.0-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"packageName": "java-1.6.0-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"packageName": "java-1.7.0-openjdk",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unknown"
}
]
},
{
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"affectedData": [
{
"vendor": "Siemens",
"product": "SIMATIC CN 4100",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V5.0",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2026-01-20T22:15:57.390",
"references": [
{
"url": "https://www.oracle.com/security-alerts/cpujan2026.html",
"tags": [
"Vendor Advisory"
],
"source": "secalert_us@oracle.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:0847",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:0848",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:0895",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:0897",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:0899",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:0901",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:0927",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:0928",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:0931",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:0932",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:0933",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1606",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:4832",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-21945",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429927",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21945.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-400"
}
]
},
{
"type": "Secondary",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"description": [
{
"lang": "en",
"value": "CWE-295"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."
},
{
"lang": "es",
"value": "Vulnerabilidad en el producto Oracle Java SE, Oracle GraalVM para JDK, Oracle GraalVM Enterprise Edition de Oracle Java SE (componente: Seguridad). Las versiones compatibles afectadas son Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM para JDK: 17.0.17 y 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. La vulnerabilidad fácilmente explotable permite a un atacante no autenticado con acceso a la red a través de múltiples protocolos comprometer Oracle Java SE, Oracle GraalVM para JDK, Oracle GraalVM Enterprise Edition. Los ataques exitosos de esta vulnerabilidad pueden resultar en la capacidad no autorizada de causar un bloqueo o una caída (crash) frecuentemente repetible (DoS completo) de Oracle Java SE, Oracle GraalVM para JDK, Oracle GraalVM Enterprise Edition. Nota: Esta vulnerabilidad se aplica a implementaciones de Java, típicamente en clientes que ejecutan aplicaciones Java Web Start en sandbox o applets Java en sandbox, que cargan y ejecutan código no confiable (por ejemplo, código que proviene de internet) y dependen del sandbox de Java para la seguridad. Esta vulnerabilidad no se aplica a implementaciones de Java, típicamente en servidores, que cargan y ejecutan solo código confiable (por ejemplo, código instalado por un administrador). Puntuación base CVSS 3.1 7.5 (Impactos en la disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."
}
],
"lastModified": "2026-07-15T02:18:32.323",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oracle:graalvm:21.3.16:*:*:*:enterprise:*:*:*",
"vulnerable": true,
"matchCriteriaId": "625D4829-2E57-4C05-BEFE-CE30F6D16E9B"
},
{
"criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:17.0.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AF0F6A0B-89BB-4851-9DF7-2A6C139DAF47"
},
{
"criteria": "cpe:2.3:a:oracle:graalvm_for_jdk:21.0.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FB4F8E6F-3B7D-49D8-8619-63B23F244AF4"
},
{
"criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update471:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2905151E-7D6C-4E7C-A371-941EABBF6CC7"
},
{
"criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update471:*:*:enterprise_performance_pack:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A77BE683-07F2-4A1E-8B62-E104B4866DC3"
},
{
"criteria": "cpe:2.3:a:oracle:jdk:1.8.0:update471_b50:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3605CFE2-513B-4384-9617-6F4A86DFCEF3"
},
{
"criteria": "cpe:2.3:a:oracle:jdk:11.0.29:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "58D9D6AA-C17D-49FF-93B6-444FEC757A58"
},
{
"criteria": "cpe:2.3:a:oracle:jdk:17.0.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D86D044A-6780-4DD9-85D1-B1EC64ACBF4E"
},
{
"criteria": "cpe:2.3:a:oracle:jdk:21.0.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BB7B1B52-5FE9-444B-8BD4-6CA4B2B8E78B"
},
{
"criteria": "cpe:2.3:a:oracle:jdk:25.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BD1D0136-84A2-4EAD-9641-7E96E4386CAA"
},
{
"criteria": "cpe:2.3:a:oracle:jre:1.8.0:update471:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA31F595-0796-4BED-BD29-8C55BBE3792C"
},
{
"criteria": "cpe:2.3:a:oracle:jre:1.8.0:update471:*:*:enterprise_performance_pack:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AC169A27-61AD-42C8-9127-7B8A8622450D"
},
{
"criteria": "cpe:2.3:a:oracle:jre:1.8.0:update471_b50:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8EB89776-DD1C-4117-BC7E-B263B6AA9853"
},
{
"criteria": "cpe:2.3:a:oracle:jre:11.0.29:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DF7696E8-6F94-425E-A62D-D800ED6715D1"
},
{
"criteria": "cpe:2.3:a:oracle:jre:17.0.17:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E3951FD6-E2A7-497A-97AF-976878B512CB"
},
{
"criteria": "cpe:2.3:a:oracle:jre:21.0.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BB701439-8B86-41F3-A77E-53C340FF1CB6"
},
{
"criteria": "cpe:2.3:a:oracle:jre:25.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "70279FE8-6A11-405B-80CA-B3427C11B35D"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "secalert_us@oracle.com"
}