CVE-2026-70906

Name of the Vulnerable Software and Affected Versions Oracle Java SE version 25.0.4 Oracle Java SE version 26.0.2

Description A flaw in the 2D component allows an unauthenticated attacker with network access via multiple protocols to compromise the system. This can lead to a hang or a frequently repeatable crash, resulting in a complete Denial of Service (DOS), which is a condition where a system becomes unavailable to its intended users. The issue can be triggered through APIs in the 2D component, such as via a web service providing data to these APIs. It also affects Java deployments that run untrusted code in a sandbox, such as Java Web Start applications or Java applets, which rely on the Java sandbox for security.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.