CVE-2026-70906: Oracle Java SE 2D Component DoS Flaw

CVE-2026-70906 Overview

CVE-2026-70906 is a denial-of-service vulnerability in the 2D component of Oracle Java SE. Affected versions include Oracle Java SE 25.0.4 and 26.0.2. An unauthenticated attacker with network access can exploit this flaw through multiple protocols to cause a hang or a frequently repeatable crash, resulting in a complete denial of service. Exploitation typically occurs through APIs in the 2D component, such as a web service that supplies attacker-controlled data. The vulnerability also affects Java deployments that load and run untrusted code inside the Java sandbox, including sandboxed Java Web Start applications and Java applets. Oracle addressed the issue in its August 2026 Critical Patch Update.

Critical Impact
Remote unauthenticated attackers can trigger a complete denial of service against Oracle Java SE 25.0.4 and 26.0.2 through the 2D component.

Affected Products

Oracle Java SE 25.0.4
Oracle Java SE 26.0.2
Java deployments running sandboxed Java Web Start applications or applets

Discovery Timeline

2026-08-18 - CVE-2026-70906 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70906

Vulnerability Analysis

The vulnerability resides in the 2D component of Oracle Java SE, which provides two-dimensional graphics, image manipulation, and rendering functionality. Attackers can reach the vulnerable code paths through APIs exposed to remote input, including web services that route data into 2D processing routines. Successful exploitation causes Java SE to hang or crash in a repeatable manner, terminating availability of the affected process. The flaw does not affect confidentiality or integrity, only availability, as reflected by the availability-only impact in the CVSS vector.

The attack surface extends to any Java application that accepts untrusted input and hands it to 2D APIs. This includes server-side applications processing images or graphics data, as well as client-side deployments that load remote code through Java Web Start or applets. The sandbox does not prevent exploitation because the vulnerable APIs are reachable from within sandboxed contexts.

Root Cause

Oracle has not published the specific technical root cause. Based on Oracle's advisory language, the defect is a resource-consumption or unhandled-error condition in 2D component APIs that leads to a process hang or crash when processing malformed input. See the Oracle Security Alert August 2026 for vendor guidance.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted data to any interface that forwards input to a vulnerable 2D API. Typical exploitation targets include HTTP endpoints, RMI services, and other network protocols that expose Java 2D functionality to remote input. Client-side exploitation is possible when a sandboxed applet or Java Web Start application loads adversary-controlled code.

No public proof-of-concept code is available. The vulnerability should be described in prose only until Oracle or third parties release additional technical detail.

Detection Methods for CVE-2026-70906

Indicators of Compromise

Repeated Java process hangs or crashes on hosts running Oracle Java SE 25.0.4 or 26.0.2
JVM termination events correlated with inbound traffic to services that process images or graphical data
Unexplained availability loss in Java-based web services following requests containing malformed 2D payloads

Detection Strategies

Inventory all hosts running Oracle Java SE 25.0.4 and 26.0.2 and flag them as in-scope for this CVE
Monitor JVM crash logs, hs_err_pid files, and process restart events on Java servers
Inspect web application logs for repeated requests to endpoints that invoke 2D APIs immediately preceding a crash

Monitoring Recommendations

Alert on abnormal Java process restart frequency across production and development environments
Track network traffic patterns targeting Java-based image or graphics processing services
Correlate application availability metrics with inbound requests to identify repeatable DoS patterns

How to Mitigate CVE-2026-70906

Immediate Actions Required

Apply the fixes described in the Oracle Security Alert August 2026 to all instances of Oracle Java SE 25.0.4 and 26.0.2
Identify internet-exposed Java services that expose 2D APIs to untrusted input and prioritize patching
Disable Java Web Start and applet execution on endpoints that do not require them

Patch Information

Oracle released fixes for CVE-2026-70906 as part of the August 2026 Critical Patch Update. Administrators should upgrade Oracle Java SE to the version identified in the Oracle Security Alert August 2026. Both server-side and client-side Java installations require the update.

Workarounds

Restrict network access to Java services that process untrusted image or graphics data through firewall rules or reverse-proxy filtering
Validate and constrain the size and format of data passed to 2D APIs at the application layer
Remove Java Web Start and applet support from endpoints where legacy Java client functionality is not required

bash

# Verify installed Oracle Java SE version on affected hosts
java -version

# Example: identify Java processes for patch tracking
ps -ef | grep -i java