{"id":"CVE-2026-91417","kind":"vulnerability","aliases":["CVE-2026-91417"],"related":[],"title":"Oracle Java SE: CORBA flaw lets unauthenticated network attackers cause partial denial of service","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA).  Supported versions that are affected are Oracle Java SE: 8u503 and  8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","summary":"A flaw in the CORBA component of Oracle Java SE and GraalVM Enterprise Edition can be triggered by sending crafted data to its APIs over the network, such as through a web service. A successful attack causes a partial denial of service and no confidentiality or integrity loss, per the CVSS vector.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["graalvm","java","oracle-jdk","runtime","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Run `java -version` and compare against the affected builds `8u503` and `8u503-perf`, and GraalVM Enterprise `21.3.19.1.1`.\n- Check whether the application uses CORBA APIs (for example, `org.omg.CORBA` or the IIOP stack) fed by network input; the sources do not say how to confirm this more precisely.","fix":"- Move Oracle Java SE off `8u503` and `8u503-perf` to the patched release named in Oracle's Critical Patch Update advisory (the sources do not give the version number).\n- Move Oracle GraalVM Enterprise Edition off `21.3.19.1.1` to the patched release (unknown from the sources).","status":"open","published_at":"2026-10-20T22:20:45+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T04:22:41+00:00","updated_at":"2026-10-25T04:22:41+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T04:22:41Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oracle Java SE off `8u503` and `8u503-perf` to the patched release named in Oracle's Critical Patch Update advisory (the sources do not give the version number).\n- Move Oracle GraalVM Enterprise Edition off `21.3.19.1.1` to the patched release (unknown from the sources).","reach":"network","title":"Oracle Java SE: CORBA flaw lets unauthenticated network attackers cause partial denial of service","impact":"low","summary":"A flaw in the CORBA component of Oracle Java SE and GraalVM Enterprise Edition can be triggered by sending crafted data to its APIs over the network, such as through a web service. A successful attack causes a partial denial of service and no confidentiality or integrity loss, per the CVSS vector.","category":"runtime","nicknames":[],"who_cares":["java","oracle-jdk","graalvm","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Partial denial of service of the Java process","analyst_note":"","how_to_check":"- Run `java -version` and compare against the affected builds `8u503` and `8u503-perf`, and GraalVM Enterprise `21.3.19.1.1`.\n- Check whether the application uses CORBA APIs (for example, `org.omg.CORBA` or the IIOP stack) fed by network input; the sources do not say how to confirm this more precisely.","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Teams running Oracle Java SE 8u503 or the 8u503-perf build, or Oracle GraalVM Enterprise Edition 21.3.19.1.1, where network-facing code passes data into CORBA APIs. Untrusted Java applets and untrusted Java Web Start applications are excluded from the exploit path, so systems that do not run them face less risk from that route.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000703,"input_tokens":3624,"output_tokens":682,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-91417':17A,20A '/av':210C '21.3.19.1.1':117C '3.1':200C,209C '5.3':203C '8u503':108C,111C '8u503-perf':110C 'abil':148C 'access':126C 'affect':103C 'allow':121C 'api':53B,177C 'applet':192C 'applic':188C 'attack':9A,65B,123C,140C 'avail':204C 'base':201C 'caus':10A,66B,150C 'compon':35B,97C,181C 'compromis':131C 'confidenti':74B 'corba':4A,34B,98C 'craft':49B 'cve':15A,18A 'cvss':80B,199C,206C,208C 'data':50B,175C 'denial':12A,69B,153C 'dos':157C 'easili':118C 'edit':43B,91C,116C,138C,165C 'enterpris':42B,90C,115C,137C,164C 'exploit':119C,172C 'flaw':5A,31B 'graalvm':21B,41B,89C,114C,136C,163C 'host':29B 'impact':205C 'integr':76B 'java':2A,22B,38B,86C,95C,106C,133C,160C,185C,191C 'jdk':25B 'l':218C 'l/pr':212C 'let':6A 'loss':77B 'multipl':128C 'n/a':217C 'n/ac':211C 'n/i':216C 'n/s':214C 'n/ui':213C 'network':8A,56B,125C 'note':166C 'oracl':1A,24B,37B,85C,88C,94C,105C,113C,132C,135C,159C,162C 'oracle-jdk':23B 'partial':11A,68B,152C,156C 'per':78B 'perf':112C 'product':92C 'protocol':129C 'result':145C 'runtim':26B 'score':202C 'se':3A,39B,87C,96C,107C,134C,161C 'self':28B 'self-host':27B 'send':48B 'servic':14A,62B,71B,155C,198C 'specifi':180C 'start':187C 'success':64B,139C 'suppli':174C 'support':99C 'trigger':46B 'u/c':215C 'unauthent':7A,122C 'unauthor':147C 'untrust':184C,190C 'use':183C 'vector':81B,207C 'version':100C 'via':127C 'vulner':82C,120C,143C,168C 'web':61B,186C,197C 'without':182C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Java SE 8u503 or the 8u503-perf build, or Oracle GraalVM Enterprise Edition 21.3.19.1.1, where network-facing code passes data into CORBA APIs. Untrusted Java applets and untrusted Java Web Start applications are excluded from the exploit path, so systems that do not run them face less risk from that route.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91417","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91417","severity":null,"published_at":"2026-10-20T22:20:45+00:00","modified_at":"2026-10-22T19:18:05+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}