CVE-2026-70907

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, and 26.0.2 Oracle GraalVM for JDK versions 17.0.20 and 21.0.12 Oracle GraalVM Enterprise Edition version 21.3.19

Description An issue exists in the JSSE component that allows an unauthenticated attacker with network access via TLS to cause a partial denial of service (partial DOS). This can be achieved by supplying data to APIs within the affected component, for example, through a web service, without the need for Untrusted Java Web Start applications or Untrusted Java applets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.