CVE-2026-47027: Oracle Java SE Libraries DOS Vulnerability

CVE-2026-47027 Overview

CVE-2026-47027 is a network-exploitable vulnerability in the Libraries component of Oracle Java SE. An unauthenticated attacker can exploit the flaw over multiple protocols to cause a partial denial of service in affected Java runtimes. The weakness is classified under [CWE-284: Improper Access Control].

Affected supported versions include Oracle Java SE 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1, along with Oracle GraalVM for JDK 17.0.19 and 21.0.11, and Oracle GraalVM Enterprise Edition 21.3.18. Exploitation can occur through APIs in the affected component, including web services that supply data to those APIs. Sandboxed Java Web Start applications and sandboxed Java applets that load untrusted code are also within scope.

Critical Impact
Unauthenticated remote attackers can trigger a partial denial of service against Oracle Java SE runtimes through exposed APIs and web services.

Affected Products

Oracle Java SE 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1
Oracle GraalVM for JDK 17.0.19 and 21.0.11
Oracle GraalVM Enterprise Edition 21.3.18

Discovery Timeline

2026-07-21 - CVE-2026-47027 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47027

Vulnerability Analysis

The vulnerability resides in the Libraries component of Oracle Java SE. An unauthenticated attacker with network access can reach the affected code paths through multiple protocols. Successful exploitation impacts availability only, resulting in a partial denial of service against the Java runtime.

Oracle categorizes the flaw as easily exploitable. The impact is limited to availability, with no reported effect on confidentiality or integrity. The current EPSS probability is 0.293%, placing the CVE in the 21st percentile for likelihood of exploitation activity.

Root Cause

Oracle classifies the issue under [CWE-284: Improper Access Control] within the Java SE Libraries component. Oracle's advisory does not publish low-level implementation details. The condition can be reached by supplying attacker-controlled data to APIs exposed by the affected component, including web services that forward external input into the library code paths.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. Attackers can trigger the vulnerability by sending crafted input to any application that exposes the affected Libraries APIs, such as a web service or an RPC endpoint that consumes untrusted data. The flaw also applies to client-side Java deployments, specifically sandboxed Java Web Start applications and sandboxed Java applets that load code from the internet and depend on the Java sandbox for isolation.

No verified proof-of-concept code is publicly available. Refer to the Oracle Security Alert July 2026 for vendor guidance.

Detection Methods for CVE-2026-47027

Indicators of Compromise

Repeated abnormal terminations, thread stalls, or elevated garbage collection pressure in Java processes without a corresponding workload increase.
Spikes in exceptions or timeouts logged by Java-based web services that consume external input through the affected Libraries APIs.
Anomalous inbound traffic patterns targeting endpoints that deserialize or parse untrusted payloads in Java applications.

Detection Strategies

Inventory Java SE and GraalVM installations across servers, developer workstations, and containers, then compare versions against the affected list.
Monitor Java Virtual Machine (JVM) health metrics such as heap usage, thread counts, and response latency for services exposed to untrusted networks.
Correlate application-layer errors with network telemetry to identify repeated malformed requests targeting Java-fronted APIs.

Monitoring Recommendations

Enable verbose JVM logging and forward events to a centralized SIEM for baseline comparison.
Instrument web services that accept external input with rate limiting, request size caps, and structured error reporting.
Track Oracle Critical Patch Update advisories and align vulnerability management pipelines to detect unpatched Java runtimes.

How to Mitigate CVE-2026-47027

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert July 2026 to all affected Java SE and GraalVM installations.
Restrict network exposure of Java-based services that accept untrusted input from the internet or untrusted network segments.
Audit applications that rely on the Java sandbox for security, particularly Java Web Start applications and applets that load remote code.

Patch Information

Oracle addressed CVE-2026-47027 in the July 2026 Critical Patch Update. Administrators should upgrade Oracle Java SE to versions released after 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1, and update Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition to the fixed releases listed in the advisory. See the Oracle Security Alert July 2026 for exact patch levels.

Workarounds

Place Java-facing web services behind an application-aware gateway that validates and rate-limits inbound requests.
Disable Java Web Start and applet execution on endpoints that do not require them.
Enforce network segmentation to prevent unauthenticated internet-based access to internal Java services.

bash

# Verify installed Java version against affected releases
java -version

# Example: inventory JDK versions across Linux hosts
find / -type f -name "java" 2>/dev/null -exec {} -version \;