CVE-2009-1093
LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5...
5.0 MediumFix available
LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier does not close the connection when initialization fails, which allows remote attackers to cause a denial of service (LDAP service hang).
Exploit likelihood
3.38%Down 1.0 points since Feb 4, 2022
What each source reports
NVD Score used
LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier does not close the connection when initialization fails, which allows remote attackers to cause a denial of service (LDAP service hang).
- Record
CVE-2009-1093- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-16
- Updated
- 2026-11-02
CVE List No score
LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier does not close the connection when initialization fails, which allows remote attackers to cause a denial of service (LDAP service hang).
- Record
CVE-2009-1093- Updated
- 2026-11-02
EUVDEUVD-2009-1094 No score
LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier does not close the connection when initialization fails, which allows remote attackers to cause a denial of service (LDAP service hang).
- Record
EUVD-2009-1094- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4qmv-gqgr-jxhq No score
LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5...
LdapCtx in the LDAP service in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 5.0 Update 17 and earlier; 6 Update 12 and earlier; SDK and JRE 1.3.1_24 and earlier; and 1.4.2_19 and earlier does not close the connection when initialization fails, which allows remote attackers to cause a denial of service (LDAP service hang).
- Record
GHSA-4qmv-gqgr-jxhq- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openjdk-6Debian:5.0 |
before 6b11-9.1+lenny2, plus listed versions 6b11-9.1 |
6b11-9.1+lenny2 |
java-1.6.0-openjdkRed Hat:enterprise_linux:5::client |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-debuginfoRed Hat:enterprise_linux:5::client |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-demoRed Hat:enterprise_linux:5::client |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-develRed Hat:enterprise_linux:5::client |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-javadocRed Hat:enterprise_linux:5::client |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-srcRed Hat:enterprise_linux:5::client |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdkRed Hat:enterprise_linux:5::server |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-debuginfoRed Hat:enterprise_linux:5::server |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-demoRed Hat:enterprise_linux:5::server |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
Show 91 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.6.0-openjdk-develRed Hat:enterprise_linux:5::server |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-javadocRed Hat:enterprise_linux:5::server |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-openjdk-srcRed Hat:enterprise_linux:5::server |
before 1:1.6.0.0-0.30.b09.el5 | 1:1.6.0.0-0.30.b09.el5 |
java-1.6.0-sunRed Hat:rhel_extras:4 |
before 1:1.6.0.13-1jpp.1.el4 | 1:1.6.0.13-1jpp.1.el4 |
java-1.6.0-sun-demoRed Hat:rhel_extras:4 |
before 1:1.6.0.13-1jpp.1.el4 | 1:1.6.0.13-1jpp.1.el4 |
java-1.6.0-sun-develRed Hat:rhel_extras:4 |
before 1:1.6.0.13-1jpp.1.el4 | 1:1.6.0.13-1jpp.1.el4 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:4 |
before 1:1.6.0.13-1jpp.1.el4 | 1:1.6.0.13-1jpp.1.el4 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:4 |
before 1:1.6.0.13-1jpp.1.el4 | 1:1.6.0.13-1jpp.1.el4 |
java-1.6.0-sun-srcRed Hat:rhel_extras:4 |
before 1:1.6.0.13-1jpp.1.el4 | 1:1.6.0.13-1jpp.1.el4 |
java-1.6.0-sunRed Hat:rhel_extras:5::client |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-demoRed Hat:rhel_extras:5::client |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-develRed Hat:rhel_extras:5::client |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:5::client |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:5::client |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-srcRed Hat:rhel_extras:5::client |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sunRed Hat:rhel_extras:5::server |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-demoRed Hat:rhel_extras:5::server |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-develRed Hat:rhel_extras:5::server |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-jdbcRed Hat:rhel_extras:5::server |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-pluginRed Hat:rhel_extras:5::server |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.6.0-sun-srcRed Hat:rhel_extras:5::server |
before 1:1.6.0.13-1jpp.1.el5 | 1:1.6.0.13-1jpp.1.el5 |
java-1.5.0-sunRed Hat:rhel_extras:4 |
before 0:1.5.0.18-1jpp.1.el4 | 0:1.5.0.18-1jpp.1.el4 |
java-1.5.0-sun-demoRed Hat:rhel_extras:4 |
before 0:1.5.0.18-1jpp.1.el4 | 0:1.5.0.18-1jpp.1.el4 |
java-1.5.0-sun-develRed Hat:rhel_extras:4 |
before 0:1.5.0.18-1jpp.1.el4 | 0:1.5.0.18-1jpp.1.el4 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:4 |
before 0:1.5.0.18-1jpp.1.el4 | 0:1.5.0.18-1jpp.1.el4 |
java-1.5.0-sun-pluginRed Hat:rhel_extras:4 |
before 0:1.5.0.18-1jpp.1.el4 | 0:1.5.0.18-1jpp.1.el4 |
java-1.5.0-sun-srcRed Hat:rhel_extras:4 |
before 0:1.5.0.18-1jpp.1.el4 | 0:1.5.0.18-1jpp.1.el4 |
java-1.5.0-sunRed Hat:rhel_extras:5::client |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sun-demoRed Hat:rhel_extras:5::client |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sun-develRed Hat:rhel_extras:5::client |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:5::client |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sun-pluginRed Hat:rhel_extras:5::client |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sun-srcRed Hat:rhel_extras:5::client |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sunRed Hat:rhel_extras:5::server |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sun-demoRed Hat:rhel_extras:5::server |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sun-develRed Hat:rhel_extras:5::server |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sun-jdbcRed Hat:rhel_extras:5::server |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sun-pluginRed Hat:rhel_extras:5::server |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-sun-srcRed Hat:rhel_extras:5::server |
before 0:1.5.0.18-1jpp.1.el5 | 0:1.5.0.18-1jpp.1.el5 |
java-1.5.0-ibmRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibm-develRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:4 |
before 1:1.5.0.9-1jpp.5.el4 | 1:1.5.0.9-1jpp.5.el4 |
java-1.5.0-ibmRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-accessibilityRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-develRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:5::client |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibmRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-accessibilityRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-demoRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-develRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-javacommRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-jdbcRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-pluginRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.5.0-ibm-srcRed Hat:rhel_extras:5::server |
before 1:1.5.0.9-1jpp.3.el5 | 1:1.5.0.9-1jpp.3.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:4 |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:4 |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibm-develRed Hat:rhel_extras:4 |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:4 |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:4 |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:4 |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:4 |
before 1:1.6.0.5-1jpp.1.el4 | 1:1.6.0.5-1jpp.1.el4 |
java-1.6.0-ibmRed Hat:rhel_extras:5::client |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::client |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::client |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::client |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::client |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::client |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::client |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::client |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibmRed Hat:rhel_extras:5::server |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-accessibilityRed Hat:rhel_extras:5::server |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-demoRed Hat:rhel_extras:5::server |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-develRed Hat:rhel_extras:5::server |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-javacommRed Hat:rhel_extras:5::server |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-jdbcRed Hat:rhel_extras:5::server |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-pluginRed Hat:rhel_extras:5::server |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.6.0-ibm-srcRed Hat:rhel_extras:5::server |
before 1:1.6.0.5-1jpp.1.el5 | 1:1.6.0.5-1jpp.1.el5 |
java-1.5.0-sunRed Hat:network_satellite:5.1::el4 |
before 0:1.5.0.22-1jpp.1.el4 | 0:1.5.0.22-1jpp.1.el4 |
java-1.5.0-sun-develRed Hat:network_satellite:5.1::el4 |
before 0:1.5.0.22-1jpp.1.el4 | 0:1.5.0.22-1jpp.1.el4 |
java-1.6.0-ibmRed Hat:network_satellite:5.3::el4 |
before 1:1.6.0.7-1jpp.3.el4 | 1:1.6.0.7-1jpp.3.el4 |
java-1.6.0-ibm-develRed Hat:network_satellite:5.3::el4 |
before 1:1.6.0.7-1jpp.3.el4 | 1:1.6.0.7-1jpp.3.el4 |
java-1.6.0-ibmRed Hat:network_satellite:5.3::el5 |
before 1:1.6.0.7-1jpp.2.el5 | 1:1.6.0.7-1jpp.2.el5 |
java-1.6.0-ibm-develRed Hat:network_satellite:5.3::el5 |
before 1:1.6.0.7-1jpp.2.el5 | 1:1.6.0.7-1jpp.2.el5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-1093 is a medium vulnerability (CVSS 5.0) in Sun Jdk, published March 25, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.38%, the 88th percentile. Fixed in openjdk-6 6b11-9.1+lenny2.
References
lists.opensuse.org/opensuse-security-announce/2009-07/msg00001.html
mandriva.com/security/advisories?name=MDVSA-2009:137
secunia.com/advisories/34632
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01745133
Show 194 moreShow less
support.avaya.com/elmodocs2/security/ASA-2009-109.htm
security.gentoo.org/glsa/glsa-200911-02.xml
redhat.com/support/errata/RHSA-2009-1038.html
rhn.redhat.com/errata/RHSA-2009-1198.html
vmware.com/security/advisories/VMSA-2009-0016.html
marc.info?l=bugtraq&m=124344236532162&w=2
securitytracker.com/id?1021893
sunsolve.sun.com/search/document.do?assetkey=1-21-118667-19-1
vupen.com/english/advisories/2009/1426
securityfocus.com/archive/1/507985/100/0/threaded
oracle.com/technetwork/topics/security/cpujul2009-091332.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11343
ubuntu.com/usn/usn-748-1
debian.org/security/2009/dsa-1769
nvd.nist.gov/vuln/detail/CVE-2009-1093
github.com/advisories/GHSA-4qmv-gqgr-jxhq
access.redhat.com/errata/RHSA-2009:0377
blogs.sun.com/security/entry/advance_notification_of_security_updates4
bugzilla.redhat.com/show_bug.cgi?id=395481
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0377.json
cve.org/CVERecord?id=CVE-2006-2426
ibm.com/developerworks/java/jdk/alerts
This page doesn't list everything
Left out here: 66 references. The JSON record has them.