CVE-2026-70907: Oracle Java SE JSSE DOS Vulnerability

CVE-2026-70907 is a denial of service vulnerability in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition affecting the JSSE component. Attackers can exploit this via TLS to cause partial DOS. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-70907 Overview

CVE-2026-70907 is a network-exploitable vulnerability in the Java Secure Socket Extension (JSSE) component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. An unauthenticated attacker with network access via Transport Layer Security (TLS) can trigger a partial denial of service against affected runtimes. Exploitation requires supplying crafted data to APIs in the JSSE component, typically through a web service endpoint, without needing Java Web Start applications or applets. The flaw is categorized under [CWE-284] Improper Access Control.

Critical Impact
Unauthenticated remote attackers can degrade availability of Java-based services by sending crafted TLS traffic to exposed JSSE endpoints.

Affected Products

Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2
Oracle GraalVM for JDK: 17.0.20, 21.0.12
Oracle GraalVM Enterprise Edition: 21.3.19

Discovery Timeline

2026-08-18 - CVE-2026-70907 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70907

Vulnerability Analysis

The vulnerability resides in the JSSE component, which implements TLS and Secure Sockets Layer (SSL) protocols for Java runtimes. An attacker can reach the vulnerable code path by initiating TLS communication with any service that terminates TLS using the affected Java implementation. Successful exploitation causes a partial denial of service, degrading availability but not compromising confidentiality or integrity.

Because JSSE handles TLS termination for a wide range of Java applications, including web servers, application servers, and microservices, the attack surface extends across most internet-facing Java workloads. The vulnerability affects long-term support (LTS) releases spanning Java 8 through Java 26, indicating a defect in shared cryptographic handshake or session-handling logic.

Root Cause

Oracle classifies the weakness under [CWE-284] Improper Access Control. The JSSE component fails to enforce proper constraints when processing certain TLS protocol data supplied through public APIs. This allows an unauthenticated peer to influence internal state in a way that consumes resources or interrupts service handling. Oracle has not published low-level technical details in the advisory.

Attack Vector

Exploitation occurs over the network through TLS. The attacker connects to any exposed service that uses the vulnerable JSSE stack and supplies crafted protocol data during or after the handshake. No authentication, user interaction, or privileged position is required. See the Oracle Security Alert for advisory details.

The vulnerability manifests during processing of TLS input via JSSE APIs. See the Oracle Security Alert for technical references; no verified proof-of-concept code is publicly available at this time.

Detection Methods for CVE-2026-70907

Indicators of Compromise

Unexpected termination or restart of Java processes hosting TLS listeners, particularly java processes serving HTTPS or mutual TLS (mTLS) endpoints.
Repeated incomplete TLS handshakes from a small set of source addresses immediately preceding service degradation.
Spikes in TLS-related exceptions in application logs, such as SSLHandshakeException or SSLProtocolException from the JSSE stack.

Detection Strategies

Inventory Java runtimes and GraalVM installations across the estate and correlate versions against the affected release list.
Monitor TLS endpoint availability with synthetic probes to catch partial denial-of-service conditions early.
Review network telemetry for anomalous handshake failure rates from external clients to Java-fronted services.

Monitoring Recommendations

Ingest Java Virtual Machine (JVM) and application logs into a centralized data lake and alert on JSSE exception spikes.
Track process restart counts and heap or thread exhaustion metrics on hosts running Java TLS services.
Enable network flow logging on TLS listener ports to identify sources generating disproportionate handshake volume.

How to Mitigate CVE-2026-70907

Immediate Actions Required

Apply the August 2026 Oracle Critical Patch Update to all affected Java SE and GraalVM installations.
Identify third-party applications that bundle a private Java runtime and update those runtimes independently.
Restrict network exposure of Java TLS endpoints to required client ranges where feasible.

Patch Information

Oracle addressed CVE-2026-70907 in the August 2026 Critical Patch Update. Refer to the Oracle Security Alert for the fixed release versions of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Upgrade all affected runtimes to the versions listed in the advisory.

Workarounds

Place a hardened TLS-terminating reverse proxy in front of vulnerable Java services to shield the JSSE stack from direct client traffic.
Apply rate limiting and connection throttling at the network edge to reduce impact of handshake-based abuse.
Enforce mutual TLS or IP allow-listing on internal services that do not need public reachability.

bash

# Verify installed Java runtime version
java -version

# Locate all Java installations on Linux hosts
find / -name "java" -type f 2>/dev/null -exec {} -version \;

# Example: rate-limit TLS handshakes with iptables
iptables -A INPUT -p tcp --dport 443 -m conntrack --ctstate NEW \
  -m limit --limit 30/second --limit-burst 60 -j ACCEPT