CVE-2026-47021: Oracle Java SE Denial of Service Vulnerability

CVE-2026-47021 Overview

CVE-2026-47021 is a denial of service vulnerability in the 2D component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. An unauthenticated attacker with network access can exploit the flaw via multiple protocols to cause a partial denial of service in affected Java runtimes. The vulnerability is classified under [CWE-400] (Uncontrolled Resource Consumption) and impacts availability only, with no effect on confidentiality or integrity. Exploitation can occur through APIs in the 2D component, including web services that supply data to those APIs, and through sandboxed Java Web Start applications or applets that load untrusted code.

Critical Impact
An unauthenticated remote attacker can degrade the availability of Java-based services and applications processing untrusted 2D component input.

Affected Products

Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1
Oracle GraalVM for JDK: 17.0.19 and 21.0.11
Oracle GraalVM Enterprise Edition: 21.3.18

Discovery Timeline

2026-07-21 - CVE-2026-47021 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47021

Vulnerability Analysis

The flaw resides in the 2D component of the Java runtime, which handles graphics rendering, image parsing, and font operations. The component fails to bound resource consumption when processing crafted input, allowing an attacker to trigger excessive resource use that degrades service availability. Because the attack surface includes any API path that feeds data into 2D routines, server-side applications that accept image or font data from untrusted sources are exposed. The vulnerability also applies to sandboxed Java Web Start applications and applets that rely on the Java sandbox to isolate untrusted code.

EPSS data as of 2026-07-23 reports an exploit probability of 0.293% (percentile 21.443). No public proof-of-concept, exploit database entry, or CISA KEV listing has been recorded at the time of publication.

Root Cause

The root cause is uncontrolled resource consumption within the 2D subsystem. The component processes attacker-controlled input without enforcing sufficient limits on memory, CPU cycles, or processing time, mapping to [CWE-400]. Malformed or oversized graphical data forces the runtime into expensive operations that starve legitimate workloads.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. Attackers deliver crafted payloads to any endpoint that routes data into 2D APIs, such as image upload handlers, PDF rendering services, or reporting engines. In client scenarios, a malicious applet or Web Start application loaded from an untrusted origin can invoke the vulnerable APIs and degrade the host runtime.

No verified exploitation code is publicly available. Refer to the Oracle Security Alert July 2026 for vendor technical details.

Detection Methods for CVE-2026-47021

Indicators of Compromise

Sustained high CPU or memory consumption by Java processes correlated with inbound requests carrying image, font, or 2D graphics payloads.
Repeated Java thread stalls or timeouts in services that invoke java.awt, javax.imageio, or Java 2D rendering APIs.
Unexplained restarts of Java application servers processing untrusted client-supplied media.

Detection Strategies

Inspect application logs for exceptions and timeouts originating in the 2D rendering path when handling external input.
Correlate network requests containing image, font, or graphic MIME types with subsequent JVM resource spikes.
Compare running JDK and GraalVM versions against the affected version list and flag unpatched instances.

Monitoring Recommendations

Baseline normal JVM CPU, heap, and thread usage for services exposing 2D-driven endpoints and alert on sustained deviations.
Enable JMX or OpenTelemetry metrics for garbage collection pauses and thread contention on Java workloads.
Track upload endpoints that accept graphical content for anomalous request rates or oversized payloads.

How to Mitigate CVE-2026-47021

Immediate Actions Required

Inventory all Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition installations and identify versions listed as affected.
Apply the July 2026 Oracle Critical Patch Update to every affected runtime as soon as change windows allow.
Restrict or validate untrusted image, font, and 2D content submitted to server-side Java applications until patching completes.

Patch Information

Oracle addressed CVE-2026-47021 in the July 2026 Critical Patch Update. Administrators should upgrade to the fixed releases published in the Oracle Security Alert July 2026 advisory for Java SE, GraalVM for JDK, and GraalVM Enterprise Edition.

Workarounds

Disable or block execution of untrusted Java Web Start applications and applets on client endpoints.
Enforce request size limits and MIME type validation on endpoints that pass data to 2D APIs.
Isolate Java services processing untrusted media in resource-capped containers to contain partial denial of service impact.

bash

# Configuration example: cap JVM resource usage in a container until patching completes
docker run --cpus="2" --memory="2g" --pids-limit=512 \
  -e JAVA_OPTS="-Xmx1500m -XX:MaxMetaspaceSize=256m -XX:+ExitOnOutOfMemoryError" \
  my-java-app:patched