CVE-2026-46917 Details
Description
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
A vulnerability has been identified in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, specifically within the JSSE component. The affected versions include Oracle Java SE 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1, as well as Oracle GraalVM for JDK 17.0.19 and 21.0.11, and Oracle GraalVM Enterprise Edition 21.3.18. This vulnerability allows an unauthenticated attacker with network access via TLS to compromise the affected Java environments. Exploitation can lead to an unauthorized partial denial-of-service, causing some disruption to the application's availability. The vulnerability can be exploited by sending data to specific APIs within the JSSE component, without the need for Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.oracle.com/security-alerts/cpujul2026.html | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| oracle graalvm | 21.3.18 |
CPE
Remediation
| |
| oracle graalvm for jdk | 17.0.19 21.0.11 |
CPE
Remediation
| |
| oracle jre | 11.0.31 17.0.19 21.0.11 25.0.3 26.0.1 |
CPE
Remediation
| |
| oracle jdk | 11.0.31 17.0.19 21.0.11 25.0.3 26.0.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | Initial Analysis | [email protected] |
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |