CVE-2026-47057: Oracle Java SE Scripting DOS Vulnerability

CVE-2026-47057 is a denial of service vulnerability in Oracle Java SE Scripting component affecting versions 8u491, 8u491-perf, and 11.0.31. Attackers can cause system crashes remotely without authentication. This article covers technical details, affected versions, impact analysis, and mitigation strategies.

CVE-2026-47057 Overview

CVE-2026-47057 is a denial-of-service vulnerability in the Scripting component of Oracle Java SE. Affected versions include Oracle Java SE 8u491, 8u491-perf, and 11.0.31. An unauthenticated attacker with network access can exploit the flaw through multiple protocols to cause a hang or repeatable crash of the Java runtime. The vulnerability is classified under CWE-400: Uncontrolled Resource Consumption and impacts availability only. Attack surfaces include web services that pass data to the Scripting APIs and sandboxed Java Web Start applications or applets loading untrusted code.

Critical Impact
Remote, unauthenticated attackers can force a complete denial of service against Oracle Java SE processes without user interaction.

Affected Products

Oracle Java SE 8u491
Oracle Java SE 8u491-perf
Oracle Java SE 11.0.31

Discovery Timeline

2026-07-21 - CVE-2026-47057 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47057

Vulnerability Analysis

The vulnerability resides in the Scripting component of Oracle Java SE. Oracle's advisory indicates the flaw is easily exploitable by unauthenticated attackers over the network. Successful exploitation results in a hang or frequently repeatable crash, producing a complete denial of service against the Java process. The flaw does not permit disclosure or modification of data. It affects deployments that expose Scripting APIs to untrusted input, including server-side web services and client-side sandboxed Java Web Start applications and applets.

Root Cause

The underlying weakness maps to CWE-400: Uncontrolled Resource Consumption. The Scripting component processes attacker-controlled input in a manner that exhausts CPU, memory, or thread resources, leading to a hang or crash of the Java runtime. Oracle has not published detailed technical internals in the public alert.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. Attackers deliver crafted input to any interface that feeds data to the Scripting APIs. Common paths include HTTP-facing web services that evaluate script content, and sandboxed Java Web Start or applet clients that load remote code. Refer to the Oracle Security Alert July 2026 for vendor-issued technical details.

// No verified proof-of-concept code is publicly available.
// The vulnerability triggers via untrusted input passed to Java SE Scripting APIs,
// causing uncontrolled resource consumption and a repeatable crash or hang.

Detection Methods for CVE-2026-47057

Indicators of Compromise

Repeated JVM crashes or hs_err_pid*.log files generated on hosts running Oracle Java SE 8u491, 8u491-perf, or 11.0.31.
Sudden CPU or memory exhaustion in Java processes correlated with inbound requests to endpoints that invoke Scripting APIs.
Application server restarts or unresponsive worker threads following receipt of unusual script or serialized payloads.

Detection Strategies

Inventory Java runtimes across the environment and flag hosts running affected versions.
Instrument web services that expose scripting functionality with request-size, execution-time, and payload-content monitoring.
Correlate JVM crash events with upstream network requests to identify externally triggered denial-of-service attempts.

Monitoring Recommendations

Ship JVM crash logs and application server error logs to a centralized log platform for pattern analysis.
Alert on repeated OutOfMemoryError, thread pool saturation, or process restart events on Java hosts.
Monitor perimeter traffic for anomalous payloads targeting endpoints known to accept script input.

How to Mitigate CVE-2026-47057

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all systems running Oracle Java SE 8u491, 8u491-perf, or 11.0.31.
Identify and restrict network exposure of services that pass untrusted input to Java Scripting APIs.
Disable Java Web Start and browser applet execution where they are not required.

Patch Information

Oracle addresses CVE-2026-47057 in the Oracle Security Alert July 2026. Administrators should upgrade affected Java SE installations to the fixed releases listed in the advisory. Prioritize internet-facing servers and any client fleets that execute sandboxed Java content.

Workarounds

Block or rate-limit inbound requests to services that evaluate scripts using Oracle Java SE Scripting APIs.
Remove or disable script engine usage in applications that do not require it.
Enforce input validation and payload size limits at the application or reverse-proxy layer to reduce resource exhaustion risk.

bash

# Verify installed Java version and remove unused script engines from application classpath
java -version
# Example: disable Nashorn or third-party script engines where not required
java -Dnashorn.args=--no-syntax-extensions -jar application.jar