CVE-2026-46917

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1 Oracle GraalVM for JDK versions 17.0.19 and 21.0.11 Oracle GraalVM Enterprise Edition version 21.3.18

Description A flaw in the JSSE component allows an unauthenticated attacker with network access via TLS to cause a partial denial of service. This issue can be exploited by providing data to APIs within the affected component, for example, through a web service, without requiring the use of Untrusted Java Web Start applications or Untrusted Java applets.

Recommendations Update Oracle Java SE to versions 11.0.32, 17.0.20, 21.0.12, 25.0.4, and 26.0.2. Update Oracle GraalVM for JDK to versions 17.0.20 and 21.0.12. Update Oracle GraalVM Enterprise Edition to a version newer than 21.3.18.