CVE-2026-70906: Oracle Java SE 2D Component DOS Vulnerability

CVE-2026-70906 Overview

CVE-2026-70906 is a denial-of-service vulnerability in the 2D component of Oracle Java SE. Affected versions are Oracle Java SE 25.0.4 and 26.0.2. An unauthenticated attacker can exploit the flaw over the network using multiple protocols, requiring no user interaction. Successful exploitation causes a process hang or repeatable crash, resulting in complete availability loss. The issue is classified under CWE-400: Uncontrolled Resource Consumption.

Critical Impact
A remote, unauthenticated attacker can trigger a complete denial of service against Java SE workloads processing untrusted input through the 2D APIs.

Affected Products

Oracle Java SE 25.0.4
Oracle Java SE 26.0.2
Java Web Start applications and sandboxed Java applets that load untrusted code

Discovery Timeline

2026-08-18 - CVE-2026-70906 published to NVD
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-70906

Vulnerability Analysis

The vulnerability resides in the 2D graphics component of Oracle Java SE. The 2D subsystem handles rendering primitives, image decoding, and font processing. Malformed or specifically crafted input passed through the 2D APIs triggers uncontrolled resource consumption. This produces either a hang or a repeatable crash of the Java runtime.

The flaw is exposed whenever a Java process accepts attacker-controlled data through the 2D APIs. Common exposure paths include web services that supply data to image or font parsing routines. Sandboxed Java Web Start applications and applets that load untrusted code are also in scope.

Root Cause

The issue maps to CWE-400: Uncontrolled Resource Consumption. The 2D component fails to constrain processing of malformed input, allowing an attacker to exhaust CPU, memory, or thread resources. Oracle has not published low-level implementation details in the Oracle Security Alert August 2026.

Attack Vector

Attackers deliver crafted input to any endpoint that funnels data into the 2D APIs. A representative scenario is a web service that accepts image data or font resources from remote clients. No credentials, elevated privileges, or user interaction are required. The attack traverses the network and completes with low complexity.

No public proof-of-concept exploit is available. The EPSS score is 0.441% as of 2026-08-23. See the Oracle Security Alert August 2026 for vendor guidance.

Detection Methods for CVE-2026-70906

Indicators of Compromise

Java Virtual Machine (JVM) processes entering unresponsive states or repeatedly crashing with 2D-related stack frames such as sun.java2d.* or java.awt.image.*.
Sustained CPU saturation on Java worker threads that correlate with inbound requests carrying image, font, or graphics payloads.
Fatal error logs (hs_err_pid*.log) referencing the 2D subsystem after processing untrusted content.

Detection Strategies

Instrument Java services with JVM monitoring to alert on thread hangs, GC storms, and abnormal process termination in 2D code paths.
Inspect web application logs for anomalous requests supplying oversized or malformed images and fonts to endpoints that invoke Java 2D APIs.
Correlate application crashes with upstream network sources to identify repeated exploitation attempts against the same endpoint.

Monitoring Recommendations

Track process restarts and OutOfMemoryError events on Java hosts running versions 25.0.4 or 26.0.2.
Monitor network gateways for repeated POSTs of image or font payloads to Java-backed APIs.
Enable JVM crash dump collection and forward hs_err_pid*.log files to a centralized log platform for review.

How to Mitigate CVE-2026-70906

Immediate Actions Required

Inventory all Java SE deployments and identify hosts running Oracle Java SE 25.0.4 or 26.0.2.
Apply the fixes referenced in the Oracle Security Alert August 2026 as soon as they are validated in staging.
Restrict network exposure of services that route untrusted input into Java 2D APIs until patches are deployed.
Enforce input size and content-type validation on endpoints that accept image, font, or graphics data.

Patch Information

Oracle addresses this vulnerability in the August 2026 Critical Patch Update. Refer to the Oracle Security Alert August 2026 for patched build numbers and download instructions. Apply the vendor-supplied Java SE update to remediate the flaw.

Workarounds

Front Java services with a reverse proxy or web application firewall (WAF) that rejects oversized or malformed image and font uploads.
Disable or block Java Web Start and applet execution on endpoints that do not require them.
Apply per-request timeouts and resource quotas to Java worker threads to limit the blast radius of a hang.

bash

# Confirm running Java version before and after patching
java -version

# Example: enforce request body size limits at an nginx reverse proxy
# in front of a Java service exposing 2D APIs
client_max_body_size 1m;
proxy_read_timeout 15s;