Live › vulnerability › CVE-2026-101737
Go to dashboardA flaw in the Compiler component of Oracle Java SE 26.0.2 can be triggered by supplying crafted data to its APIs, such as through a web service. An unauthenticated remote attacker can cause a hang or repeatable crash of the Java runtime, a denial of service with no code execution or data exposure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running Oracle Java SE 26.0.2 that expose APIs in the Compiler component to untrusted network input, such as web services. Applications that do not pass external data to these APIs and do not run untrusted applets or Web Start apps are much less exposed.
No product ranges from the sources yet.
java -version and check whether it reports Oracle Java SE 26.0.2.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in Oracle Java SE (component: Compiler). The supported version that is affected is Oracle Java SE: 26.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-101737")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.