How do I check whether I am affected by CVE-2026-91451?

- Run `java -version` and compare against the affected releases: 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and GraalVM 17.0.20.1, 21.0.12.1, 21.3.19.1.1. - Check whether any service built on Java parses untrusted network input through the Networking APIs.

What is the fix for CVE-2026-91451?

- Oracle Java SE: move to a patched release from Oracle's April 2026 Critical Patch Update (the exact fixed builds are unknown from these sources). - Oracle GraalVM: move to a patched GraalVM release for your line.

Who is not affected by CVE-2026-91451?

Not affected if: applets-and-web-start-only, no-untrusted-network-input.

Live › vulnerability › CVE-2026-91451

Go to dashboard

medium5.3Runtime

Oracle Java SE: Networking flaw lets unauthenticated remote users alter some data

A flaw in the Networking component of Oracle Java SE lets an unauthenticated attacker over the network change or delete some data the Java application can access. The attack works by supplying data to APIs in that component, such as through a web service, and does not need Java Web Start or applets.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

5.3

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 22, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: No.
Reachable from: internet.
Worst case: Attacker can alter or delete some data the Java application can reach.
CVSS said: 5.3. The facts above say high; we keep the sources' medium until an analyst looks.

Who is affected

Any Java SE or GraalVM runtime at the listed versions is affected when an application passes network-supplied data into the Networking APIs. Standalone Java tools that never receive untrusted network input are less exposed. Systems that only run desktop Java applets or Java Web Start are not the target of this flaw.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-91451

Go to dashboard

medium5.3Runtime

Oracle Java SE: Networking flaw lets unauthenticated remote users alter some data

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

5.3

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 22, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: No.
Reachable from: internet.
Worst case: Attacker can alter or delete some data the Java application can reach.
CVSS said: 5.3. The facts above say high; we keep the sources' medium until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

Oracle Java SE: Networking flaw lets unauthenticated remote users alter some data

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

Oracle Java SE: Networking flaw lets unauthenticated remote users alter some data

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources