CVE-2026-21945: Oracle Java SE DoS Vulnerability

CVE-2026-21945 Overview

CVE-2026-21945 is a Denial of Service (DoS) vulnerability affecting the Security component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. This vulnerability allows an unauthenticated attacker with network access to cause a complete denial of service condition, resulting in a hang or frequently repeatable crash of the affected products.

The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption), indicating that the flaw enables attackers to exhaust system resources through specially crafted requests. This is particularly concerning for Java deployments running sandboxed applications that process untrusted code from external sources.

Critical Impact

Unauthenticated remote attackers can cause complete service unavailability through network-based exploitation, affecting Java applications that rely on sandbox security for processing untrusted code.

Affected Products

• Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1
• Oracle GraalVM for JDK: 17.0.17, 21.0.9
• Oracle GraalVM Enterprise Edition: 21.3.16

Discovery Timeline

• 2026-01-20 - CVE-2026-21945 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2026-21945

Vulnerability Analysis

This vulnerability resides in the Security component of Oracle's Java platforms and manifests as an uncontrolled resource consumption issue. The flaw is easily exploitable and does not require authentication or user interaction, making it accessible to any attacker with network connectivity to the target system.

The vulnerability specifically impacts Java deployments that execute untrusted code within sandboxed environments, such as Java Web Start applications and Java applets. When exploited, it causes the Java Virtual Machine (JVM) to enter a hung state or experience frequent crashes, resulting in complete unavailability of the affected application.

Importantly, Oracle notes that this vulnerability does not affect server-side Java deployments that exclusively run trusted, administrator-installed code. The risk is concentrated on client-side deployments where the Java sandbox is the primary security boundary for executing potentially malicious code from the internet.

Root Cause

The root cause is attributed to CWE-400: Uncontrolled Resource Consumption within the Security component. This indicates improper handling of resource allocation when processing certain inputs, allowing attackers to trigger excessive consumption of system resources such as memory or CPU cycles, ultimately leading to service disruption.

Attack Vector

The attack can be executed remotely over the network via multiple protocols. An unauthenticated attacker can send specially crafted requests or malicious code to a vulnerable Java application running in a sandboxed environment. The attack requires no privileges or user interaction, and exploitation complexity is low.

The attack targets the Security component's resource management mechanisms. When a vulnerable Java deployment processes malicious input designed to trigger the resource exhaustion condition, the JVM becomes unresponsive or crashes repeatedly, denying service to legitimate users.

Detection Methods for CVE-2026-21945

Indicators of Compromise

• Unexpected JVM crashes or hangs occurring frequently without apparent cause
• Abnormal resource consumption patterns (CPU spikes, memory exhaustion) in Java processes
• Log entries indicating Security component failures or exceptions during untrusted code execution
• Network traffic patterns showing repeated connections attempting to load Java applets or Web Start applications

Detection Strategies

• Deploy application performance monitoring to detect anomalous JVM behavior and resource consumption
• Implement network intrusion detection rules to identify suspicious patterns targeting Java client applications
• Configure Java logging to capture Security component exceptions and audit untrusted code execution attempts
• Establish baseline metrics for normal JVM performance to enable detection of resource exhaustion conditions

Monitoring Recommendations

• Monitor JVM process health metrics including heap usage, garbage collection frequency, and thread states
• Track network connections to systems running vulnerable Java versions for unusual activity patterns
• Set up alerting for repeated JVM restarts or crash events that may indicate active exploitation
• Review Java security logs for failed sandbox operations or resource limit violations

How to Mitigate CVE-2026-21945

Immediate Actions Required

• Inventory all systems running affected Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition versions
• Prioritize patching for client-side deployments that execute untrusted code in sandboxed environments
• Disable Java Web Start and Java applets in web browsers where not strictly required
• Implement network segmentation to limit exposure of vulnerable Java clients

Patch Information

Oracle has released security updates addressing this vulnerability as part of their January 2026 Critical Patch Update. Organizations should apply the latest patches from Oracle to remediate this vulnerability. The official security advisory is available at the Oracle Security Alert January 2026.

For environments where immediate patching is not feasible, organizations should evaluate the risk based on their deployment model. Server-side deployments running only trusted code are not affected by this vulnerability.

Workarounds

• Disable execution of untrusted Java code by configuring browser security settings to block Java applets
• Implement application whitelisting to prevent execution of unauthorized Java applications
• Configure Java security policies to restrict resource consumption by sandboxed applications
• Consider migrating from Java Web Start and applet-based deployments to more secure delivery mechanisms