openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10)

A flaw was found in the Java Secure Socket Extension JSSE component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability over a Transport Layer Security TLS connection to perform unauthorized modification, insertion, or deletion of accessible data. Exploitation occurs...

openjdk: Enhance XML Processing (Oracle CPU 2026-10)

A flaw was found in the Java API for XML Processing JAXP component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting crafted data across the network to applications that expose JAXP interfaces, such as through a web service. Successful exploitation can...

openjdk: Enhance Network Clients (Oracle CPU 2026-10)

A flaw was found in the OpenJDK networking component. This vulnerability may allow an unauthenticated remote attacker to cause unauthorized data modification. By supplying crafted input to exposed networking application programming interfaces APIs, such as through a web service, an attacker can...

openjdk: Enhance Template Handling (Oracle CPU 2026-10)

A flaw was found in the JAXP Java API for XML Processing component of OpenJDK. An unauthenticated remote attacker can exploit this vulnerability by providing crafted input to applications or web services that process data through JAXP APIs. Successful exploitation allows the attacker to perform...

openjdk: Enhance HTTP Client (Oracle CPU 2026-10)

A flaw was found in OpenJDK's Networking component. An unauthenticated remote attacker with network access can exploit this vulnerability by sending crafted input to exposed networking Application Programming Interfaces APIs. Successful exploitation allows the attacker to perform unauthorized dat...

openjdk: Improve ciphertext handling (Oracle CPU 2026-10)

A flaw was found in the Security component of Oracle Java SE. An unauthenticated remote attacker with network access could exploit this flaw by supplying crafted input to exposed application programming interfaces APIs or by executing untrusted code within sandboxed environments. A successful...

openjdk: Enhance Image Handling (Oracle CPU 2026-10)

A flaw was found in OpenJDK's Abstract Window Toolkit AWT. A remote attacker with low privileges could exploit this vulnerability by convincing a user to run untrusted code within a sandboxed environment. Successful exploitation allows unauthorized read access to a subset of accessible data,...

openjdk: Enhance TLS handshakes (Oracle CPU 2026-10)

A flaw was found in OpenJDK's Java Secure Socket Extension JSSE component. An unauthenticated remote attacker with network access via Transport Layer Security TLS can exploit this vulnerability to cause a partial Denial of Service DoS. This issue can be triggered when an application or web servic...

openjdk: Enhance krb5 tokens (Oracle CPU 2026-10)

A flaw was found in the Java Generic Security Services JGSS component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted requests to exposed application programming interfaces APIs, such as through a web service. A successful attack...

openjdk: Enhance Kerberos validation (Oracle CPU 2026-10)

A flaw was found in OpenJDK's Java Generic Security Services JGSS component. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code within a sandboxed Java environment. Successful exploitation results in unauthorized information disclosure...

openjdk: Enhance C2 comparisons (Oracle CPU 2026-10)

A flaw was found in the OpenJDK Compiler component. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted data to exposed application programming interfaces APIs, such as through a web service. Successful exploitation could allow the attacker to read, update, or...

openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10)

A flaw was found in OpenJDK's Serviceability component. An unauthenticated attacker with local access to the host system can exploit this vulnerability with user interaction, such as by supplying crafted input to Serviceability application programming interfaces APIs. A successful attack can resu...

openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)

A flaw was found in the Sound component of Java SE and GraalVM. This issue allows an unauthenticated remote attacker to cause a partial Denial of Service DoS by convincing a user to run untrusted code within a sandboxed Java environment...

openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10)

A flaw was found in OpenJDK. An unauthenticated remote attacker can exploit this issue across multiple network protocols by submitting crafted requests to application programming interfaces APIs within the Security component. Successful exploitation allows an attacker to modify or delete accessib...

openjdk: Enhance font rendering (Oracle CPU 2026-10)

A flaw was found in OpenJDK's 2D component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to exposed application programming interfaces APIs, such as through a web service or application that processes graphics data. A successful attack...

openjdk: Enhance GIF loading (Oracle CPU 2026-10)

A flaw was found in OpenJDK's ImageIO component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to applications utilizing ImageIO APIs. Successful exploitation can result in a partial Denial of Service DoS, degrading application...

openjdk: Enhance HTTP server (Oracle CPU 2026-10)

A flaw was found in the Networking component of Oracle Java SE and GraalVM. An unauthenticated remote attacker can exploit this vulnerability by submitting crafted data across the network to exposed application programming interfaces APIs, such as through a web service. A successful attack can...

openjdk: Enhance jmod handling (Oracle CPU 2026-10)

A flaw was found in openjdk. An unauthenticated attacker with local access to the host system could leverage this vulnerability in the Libraries component by convincing a user to interact with a malicious application or by supplying crafted input through exposed application programming interfaces...

openjdk: Enhance Preferences (Oracle CPU 2026-10)

A flaw was found in the OpenJDK Utility component. An unauthenticated attacker with local system access or the ability to supply data to affected application programming interfaces APIs can exploit this vulnerability. Successful exploitation can result in unauthorized data access, allowing an...

openjdk: Improve HTTP headers (Oracle CPU 2026-10)

A flaw was found in OpenJDK's Lightweight HTTP Server. An unauthenticated remote attacker can exploit this vulnerability over the network by sending crafted requests to exposed server Application Programming Interfaces APIs. Successful exploitation allows an attacker to perform unauthorized data...

openjdk: Enhance TLS Extensions (Oracle CPU 2026-10)

A flaw was found in the Java Secure Socket Extension JSSE component. An unauthenticated remote attacker could exploit this vulnerability over Transport Layer Security TLS by sending crafted data to affected application programming interfaces APIs. A successful attack allows the attacker to cause...

openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10)

A flaw was found in the OpenJDK Libraries component. An unauthenticated remote attacker can exploit this vulnerability over a network by submitting crafted data to affected application programming interfaces APIs, or through sandboxed environments that execute untrusted Java code. Successful...

openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10)

A flaw was found in OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by sending crafted requests across network protocols to exposed application programming interfaces APIs within the Security component. A successful attack can result in unauthorized modification,...

openjdk: Improve C2 loop transformations (Oracle CPU 2026-10)

A flaw was found in OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to Compiler component APIs Application Programming Interfaces, such as through a web service. A successful attack can allow unauthorized modification or deletion ...

openjdk: Enhance WebRowSets (Oracle CPU 2026-10)

A flaw was found in the Java Database Connectivity JDBC component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to exposed JDBC application programming interfaces APIs or by executing untrusted code. If successfully exploited...

openjdk: Enhance SASL Authentication (Oracle CPU 2026-10)

A flaw was found in OpenJDK. An unauthenticated remote attacker can exploit this vulnerability over a network by supplying crafted input to Application Programming Interfaces APIs within the Security component. Successful exploitation can result in unauthorized read and modification access to a...

openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10)

A flaw was found in OpenJDK. An unauthenticated remote attacker with network access could exploit this vulnerability by submitting crafted data to networking application programming interfaces APIs. A successful attack could allow unauthorized modification or deletion of accessible data, or resul...

openjdk: Enhance XPath Expressions (Oracle CPU 2026-10)

A flaw was found in the Java API for XML Processing JAXP component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to applications or web services that rely on vulnerable JAXP APIs. Successful exploitation can result in...

openjdk: Enhance JPEG loading (Oracle CPU 2026-10)

A flaw was found in OpenJDK's ImageIO component. This vulnerability allows an unauthenticated remote attacker to cause information disclosure by submitting crafted inputs to applications or web services using the ImageIO application programming interface API. Successful exploitation can result in...

openjdk: Enhance JShell (Oracle CPU 2026-10)

A flaw was found in OpenJDK's JDK tools component. An unauthenticated local attacker can exploit this vulnerability by convincing a user to interact with untrusted code in an environment relying on the Java security sandbox. A successful attack can result in unauthorized creation, modification, o...

openjdk: Enhance LDAP logins (Oracle CPU 2026-10)

A flaw was found in OpenJDK within the Java Authentication and Authorization Service JAAS component. An unauthenticated remote attacker can exploit this vulnerability over a network by sending data to affected application programming interfaces APIs. Successful exploitation results in information...

openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10)

A flaw was found in the Networking component of OpenJDK. This vulnerability allows an unauthenticated remote attacker to cause unauthorized data modification by sending crafted input to exposed Application Programming Interfaces APIs, such as through web services. Successful exploitation enables ...

openjdk: Enhance jstatd (Oracle CPU 2026-10)

A flaw was found in the Serviceability component of OpenJDK. An unauthenticated remote attacker can exploit this issue across the network by supplying crafted data to exposed application programming interfaces APIs or by running untrusted code within a sandboxed Java environment. Successful...

openjdk: Enhance HTTP client caching (Oracle CPU 2026-10)

A flaw was found in the OpenJDK Networking component. This vulnerability allows an unauthenticated remote attacker with network access to cause an information disclosure. By supplying crafted input to networking Application Programming Interfaces APIs, such as through an exposed web service, an...

openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10)

A flaw was found in OpenJDK. An unauthenticated remote attacker with network access can exploit this vulnerability through the SOCKS5 Socket Secure networking protocol to compromise data integrity. Successful exploitation allows unauthorized creation, modification, or deletion of application data...

openjdk: Enhance zipfs (Oracle CPU 2026-10)

A flaw was found in the Libraries component of OpenJDK. An unauthenticated remote attacker with network access can exploit this vulnerability by supplying crafted data to vulnerable application programming interfaces APIs. Successful exploitation allows the attacker to cause a partial Denial of...

openjdk: Enhance krb5 client (Oracle CPU 2026-10)

A flaw was found in the JGSS Java Generic Security Services component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code in deployments relying on the Java sandbox. Successful exploitation can result in unauthorized access ...

openjdk: Enhance HTTP Server (Oracle CPU 2026-10)

A flaw was found in the Java SE Networking component. An unauthenticated remote attacker can exploit this vulnerability by submitting specially crafted data to network application programming interfaces APIs, such as through a web service. Successful exploitation allows unauthorized read access t...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references

A flaw was found in crypto/tls. A remote attacker can trigger this vulnerability by sending a specially crafted packet containing multiple Encrypted Client Hello ECH outer extension references to a server. Processing these unauthorized references leads to excessive memory consumption, causing a...

net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames

A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...

org.eclipse.jetty/jetty-server: org.eclipse.jetty/jetty-proxy: Eclipse Jetty: Access control bypass via case-sensitive host filtering

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to bypass access controls and reach restricted resources. The issue occurs because the server and proxy components perform case-sensitive validation on host allowlists and denylists. By sending requests with altered...

org.eclipse.jetty/jetty-http: Jetty: HTTP request smuggling via crafted chunked requests

A flaw was found in Jetty. A remote attacker can exploit this vulnerability by sending specially crafted HTTP/1.1 chunked requests. This can cause Jetty and an intermediary proxy to interpret different request boundaries, potentially leading to HTTP request smuggling. This issue arises from Jetty...

openssl: invalid pointer dereference in CMP server via crafted protectionAlg

A flaw was found in OpenSSL. A crafted CMP Certificate Management Protocol message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client,...

com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking

A flaw was found in jackson-core. An attacker can supply specially crafted JSON that, when deserialized into a numeric target type, triggers a Regular expression Denial of Service ReDoS vulnerability. This occurs due to quadratic backtracking in the NumberInput.looksLikeValidNumber method's...

com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing

A flaw was found in FasterXML jackson-core. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted, malformed token to the JsonFactory.createParserDataInput method. The UTF8DataInputJsonParser component, responsible for handling DataInput...

com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing

A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service DoS by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar fields from JSON strings,...

org.bouncycastle/bc-java: org.bouncycastle/bctls-fips: Bouncy Castle for Java: Denial of Service via unchecked DTLS handshake reassembler buffer allocation

A flaw was found in Bouncy Castle for Java. The DTLS Datagram Transport Layer Security handshake reassembler allocates buffers based on an unchecked 24-bit length value. A remote attacker could exploit this vulnerability by sending a specially crafted DTLS handshake message, leading to excessive...

openssl: heap buffer overflow in CMS key unwrapping

A flaw was found in OpenSSL. A crafted CMS Cryptographic Message Syntax message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMSdecrypt. This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap...