CVE-2026-70907: Oracle Java SE JSSE DoS Vulnerability

CVE-2026-70907 Overview

CVE-2026-70907 is a vulnerability in the Java Secure Socket Extension (JSSE) component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. An unauthenticated attacker with network access via TLS can exploit this flaw to cause a partial denial of service. The vulnerability is easily exploitable and requires no user interaction. Oracle addressed the issue in the August 2026 Critical Patch Update.

Critical Impact
Remote unauthenticated attackers can trigger a partial availability impact against affected Java runtimes by sending crafted data to TLS-facing APIs, disrupting services that rely on JSSE.

Affected Products

Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2
Oracle GraalVM for JDK: 17.0.20 and 21.0.12
Oracle GraalVM Enterprise Edition: 21.3.19

Discovery Timeline

2026-08-18 - CVE-2026-70907 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70907

Vulnerability Analysis

The flaw resides in the Java Secure Socket Extension (JSSE), the Java library responsible for TLS/SSL protocol handling. An attacker who can reach a TLS-enabled Java service over the network can submit crafted protocol data that leads to a partial denial of service condition. The affected APIs process attacker-controlled data during TLS handshake or session handling, causing resource exhaustion or processing anomalies that degrade service availability.

Exploitation does not require authentication, credentials, or victim interaction. The attacker only needs network reach to a TLS endpoint served by a vulnerable JDK. The impact is scoped to availability; confidentiality and integrity are not affected.

Root Cause

The vulnerability is categorized under [CWE-284: Improper Access Control]. In this context, JSSE fails to properly constrain how untrusted TLS data is handled, allowing an attacker to influence resource consumption or processing flow through the exposed APIs. The condition is reachable through any Java-based service, such as a web service, that terminates TLS using the vulnerable runtime.

Attack Vector

The attack is remote and network-based over TLS. Oracle notes that the vulnerability can be exploited by supplying data to APIs in the JSSE component through a web service, and cannot be triggered via Untrusted Java Web Start applications or Untrusted Java applets. Any server-side Java process exposing TLS listeners such as HTTPS endpoints, gRPC services, LDAPS, or JMS over TLS is a candidate target. The EPSS score is 0.278% with a percentile of 20.3, reflecting limited observed exploitation activity at publication.

No public proof-of-concept code is available. Refer to the Oracle Security Alert for vendor-specific technical detail.

Detection Methods for CVE-2026-70907

Indicators of Compromise

Abnormal spikes in TLS handshake failures or aborted sessions on Java-hosted endpoints.
Sustained CPU, memory, or thread pool exhaustion in JVM processes handling TLS traffic.
Repeated malformed or anomalous ClientHello messages from a single or small set of source addresses.

Detection Strategies

Correlate JVM performance degradation events with inbound TLS connection patterns to identify externally induced resource pressure.
Inspect TLS traffic to Java services for malformed handshake sequences and unusually high connection rates from single sources.
Baseline normal JSSE handshake latency and alert on sustained deviation across production workloads.

Monitoring Recommendations

Enable JVM garbage collection and thread pool metrics on all TLS-facing Java services and forward to centralized telemetry.
Instrument application logs to capture SSLException and SSLHandshakeException frequency per remote peer.
Monitor load balancer and reverse proxy logs for elevated 5xx and connection reset rates originating from Java backends.

How to Mitigate CVE-2026-70907

Immediate Actions Required

Apply the August 2026 Oracle Critical Patch Update to all affected Java SE, GraalVM for JDK, and GraalVM Enterprise Edition installations.
Inventory all systems running the affected versions, including embedded JDKs bundled with third-party applications.
Restrict network exposure of TLS-facing Java services to trusted networks where operationally feasible until patching is complete.

Patch Information

Oracle released fixes as part of the August 2026 Critical Patch Update. Administrators should upgrade to the patched Java SE, GraalVM for JDK, and GraalVM Enterprise Edition releases listed in the Oracle Security Alert.

Workarounds

Place a TLS-terminating reverse proxy in front of vulnerable Java services to filter malformed handshakes before they reach the JVM.
Apply network-level rate limiting on TLS connection establishment to reduce the impact of resource exhaustion attempts.
Enforce strict firewall rules that limit inbound TLS access to known client ranges until the patch is deployed.

bash

# Verify installed Java version to determine exposure
java -version

# Example iptables rate-limit for TLS port 443 as an interim control
iptables -A INPUT -p tcp --dport 443 -m conntrack --ctstate NEW \
  -m limit --limit 60/minute --limit-burst 120 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -m conntrack --ctstate NEW -j DROP