{"id":"CVE-2026-101737","kind":"vulnerability","aliases":["CVE-2026-101737"],"related":[],"title":"Java SE: Compiler flaw lets remote input crash or hang Java","description":"Vulnerability in Oracle Java SE (component: Compiler).   The supported version that is affected is Oracle Java SE: 26.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).","summary":"A flaw in the Compiler component of Oracle Java SE 26.0.2 can be triggered by supplying crafted data to its APIs, such as through a web service. An unauthenticated remote attacker can cause a hang or repeatable crash of the Java runtime, a denial of service with no code execution or data exposure.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","runtime","self-hosted","web-services"],"not_affected_if":["no-untrusted-input","other-java-version"],"how_to_check":"- Run `java -version` and check whether it reports Oracle Java SE `26.0.2`.\n- Identify services that pass untrusted input to Java compiler APIs, such as web services that compile or evaluate code.","fix":"- Move Oracle Java SE to the patched release listed in Oracle's Critical Patch Update for this CVE; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-10-20T22:18:28+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T04:08:31+00:00","updated_at":"2026-10-25T04:08:31+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T04:08:31Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oracle Java SE to the patched release listed in Oracle's Critical Patch Update for this CVE; the exact fixed version is unknown from the sources.","reach":"network","title":"Java SE: Compiler flaw lets remote input crash or hang Java","impact":"low","summary":"A flaw in the Compiler component of Oracle Java SE 26.0.2 can be triggered by supplying crafted data to its APIs, such as through a web service. An unauthenticated remote attacker can cause a hang or repeatable crash of the Java runtime, a denial of service with no code execution or data exposure.","category":"runtime","nicknames":[],"who_cares":["java","self-hosted","web-services"],"confidence":0.7,"needs_auth":"no","worst_case":"Java process hangs or crashes repeatedly, causing denial of service","analyst_note":"","how_to_check":"- Run `java -version` and check whether it reports Oracle Java SE `26.0.2`.\n- Identify services that pass untrusted input to Java compiler APIs, such as web services that compile or evaluate code.","needs_analyst":false,"not_affected_if":["no-untrusted-input","other-java-version"],"who_is_affected":"Systems running Oracle Java SE 26.0.2 that expose APIs in the Compiler component to untrusted network input, such as web services. Applications that do not pass external data to these APIs and do not run untrusted applets or Web Start apps are much less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00062,"input_tokens":3500,"output_tokens":540,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101737':14A,17A '-2026':13A,16A '/av':183C '26.0.2':36B,96C '3.1':173C,182C '5.9':176C 'abil':124C 'access':106C 'affect':91C 'allow':101C 'api':46B,150C 'applet':165C 'applic':161C 'attack':56B,103C,116C 'avail':177C 'base':174C 'caus':58B,126C 'code':74B 'compil':3A,30B,85C 'complet':133C 'compon':31B,84C,154C 'compromis':111C 'craft':42B 'crash':8A,63B,132C 'cve':12A,15A 'cvss':172C,179C,181C 'data':43B,77B,148C 'denial':69B 'difficult':97C 'dos':134C 'execut':75B 'exploit':99C,145C 'exposur':78B 'flaw':4A,27B 'frequent':130C 'h':191C 'h/pr':185C 'hang':10A,60B,128C 'host':22B 'impact':178C 'input':7A 'java':1A,11A,18B,34B,66B,82C,94C,113C,137C,158C,164C 'let':5A 'multipl':108C 'n/a':190C 'n/ac':184C 'n/i':189C 'n/s':187C 'n/ui':186C 'network':105C 'note':139C 'oracl':33B,81C,93C,112C,136C 'protocol':109C 'remot':6A,55B 'repeat':62B,131C 'result':121C 'runtim':19B,67B 'score':175C 'se':2A,35B,83C,95C,114C,138C 'self':21B 'self-host':20B 'servic':25B,52B,71B,171C 'specifi':153C 'start':160C 'success':115C 'suppli':41B,147C 'support':87C 'trigger':39B 'u/c':188C 'unauthent':54B,102C 'unauthor':123C 'untrust':157C,163C 'use':156C 'vector':180C 'version':88C 'via':107C 'vulner':79C,100C,119C,141C 'web':24B,51B,159C,170C 'web-servic':23B 'without':155C","nicknames":[],"mitigations":[],"who_affected":"Systems running Oracle Java SE 26.0.2 that expose APIs in the Compiler component to untrusted network input, such as web services. Applications that do not pass external data to these APIs and do not run untrusted applets or Web Start apps are much less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101737","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101737","severity":null,"published_at":"2026-10-20T22:18:28+00:00","modified_at":"2026-10-22T18:17:17+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}