CVE-2023-38264
IBM SDK, Java Technology Edition denial of service
The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21 is vulnerable to a denial of service attack in some circumstances due to improper enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters. IBM X-Force ID: 260578.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
IBM SDK, Java Technology Edition denial of service
The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21 is vulnerable to a denial of service attack in some circumstances due to improper enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters. IBM X-Force ID: 260578.
- Record
CVE-2023-38264- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2023-42084
The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21 is vulnerable to a denial of service attack in some circumstances due to improper enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters. IBM X-Force ID: 260578.
- Record
EUVD-2023-42084- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p7p5-3hmf-xx69
The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8...
The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21 is vulnerable to a denial of service attack in some circumstances due to improper enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters. IBM X-Force ID: 260578.
- Record
GHSA-p7p5-3hmf-xx69- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21 is vulnerable to a denial of service attack in some circumstances due to improper enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters. IBM X-Force ID: 260578.
- Record
CVE-2023-38264- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVRHSA-2024:3685
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2024:3685- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2024:4160
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2024:4160- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2024:1845-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
Update to Java 8.0 Service Refresh 8 Fix Pack 25 (bsc#1223470):
- CVE-2023-38264: Fixed Object Request Broker (ORB) denial of service (bsc#1224164).
- CVE-2024-21094: Fixed C2 compilation fails with 'Exceeded _node_regs array' (bsc#1222986).
- CVE-2024-21068: Fixed integer overflow in C1 compiler address generation (bsc#1222983).
- CVE-2024-21085: Fixed Pack200 excessive memory allocation (bsc#1222984).
- CVE-2024-21011: Fixed Long Exception message leading to crash (bsc#1222979).
- CVE-2024-21012: Fixed HTTP/2 client improper reverse DNS lookup (bsc#1222987).
- Record
SUSE-SU-2024:1845-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:1859-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
Update to Java 8.0 Service Refresh 8 Fix Pack 25 (bsc#1223470):
- CVE-2023-38264: Fixed Object Request Broker (ORB) denial of service (bsc#1224164).
- CVE-2024-21094: Fixed C2 compilation fails with 'Exceeded _node_regs array' (bsc#1222986).
- CVE-2024-21068: Fixed integer overflow in C1 compiler address generation (bsc#1222983).
- CVE-2024-21085: Fixed Pack200 excessive memory allocation (bsc#1222984).
- CVE-2024-21011: Fixed Long Exception message leading to crash (bsc#1222979).
- CVE-2024-21012: Fixed HTTP/2 client improper reverse DNS lookup (bsc#1222987).
- Record
SUSE-SU-2024:1859-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1.8.0-ibmRed Hat:enterprise_linux:8::supplementary |
before 1:1.8.0.8.25-1.el8_10 | 1:1.8.0.8.25-1.el8_10 |
java-1.8.0-ibm-demoRed Hat:enterprise_linux:8::supplementary |
before 1:1.8.0.8.25-1.el8_10 | 1:1.8.0.8.25-1.el8_10 |
java-1.8.0-ibm-develRed Hat:enterprise_linux:8::supplementary |
before 1:1.8.0.8.25-1.el8_10 | 1:1.8.0.8.25-1.el8_10 |
java-1.8.0-ibm-headlessRed Hat:enterprise_linux:8::supplementary |
before 1:1.8.0.8.25-1.el8_10 | 1:1.8.0.8.25-1.el8_10 |
java-1.8.0-ibm-jdbcRed Hat:enterprise_linux:8::supplementary |
before 1:1.8.0.8.25-1.el8_10 | 1:1.8.0.8.25-1.el8_10 |
java-1.8.0-ibm-pluginRed Hat:enterprise_linux:8::supplementary |
before 1:1.8.0.8.25-1.el8_10 | 1:1.8.0.8.25-1.el8_10 |
java-1.8.0-ibm-srcRed Hat:enterprise_linux:8::supplementary |
before 1:1.8.0.8.25-1.el8_10 | 1:1.8.0.8.25-1.el8_10 |
java-1.8.0-ibm-webstartRed Hat:enterprise_linux:8::supplementary |
before 1:1.8.0.8.25-1.el8_10 | 1:1.8.0.8.25-1.el8_10 |
java-1.8.0-ibmRed Hat:rhel_extras:7 |
before 1:1.8.0.8.25-1jpp.1.el7 | 1:1.8.0.8.25-1jpp.1.el7 |
java-1.8.0-ibm-demoRed Hat:rhel_extras:7 |
before 1:1.8.0.8.25-1jpp.1.el7 | 1:1.8.0.8.25-1jpp.1.el7 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.8.0-ibm-develRed Hat:rhel_extras:7 |
before 1:1.8.0.8.25-1jpp.1.el7 | 1:1.8.0.8.25-1jpp.1.el7 |
java-1.8.0-ibm-jdbcRed Hat:rhel_extras:7 |
before 1:1.8.0.8.25-1jpp.1.el7 | 1:1.8.0.8.25-1jpp.1.el7 |
java-1.8.0-ibm-pluginRed Hat:rhel_extras:7 |
before 1:1.8.0.8.25-1jpp.1.el7 | 1:1.8.0.8.25-1jpp.1.el7 |
java-1.8.0-ibm-srcRed Hat:rhel_extras:7 |
before 1:1.8.0.8.25-1jpp.1.el7 | 1:1.8.0.8.25-1jpp.1.el7 |
java-1_8_0-ibmSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 6 CVEs |
before 1.8.0_sr8.25-30.123.1 | 1.8.0_sr8.25-30.123.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 6 CVEs |
before 1.8.0_sr8.25-30.123.1 | 1.8.0_sr8.25-30.123.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 6 CVEs |
before 1.8.0_sr8.25-30.123.1 | 1.8.0_sr8.25-30.123.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Module for Legacy 15 SP5 From an advisory covering 6 CVEs |
before 1.8.0_sr8.25-150000.3.89.1 | 1.8.0_sr8.25-150000.3.89.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Module for Legacy 15 SP6 From an advisory covering 6 CVEs |
before 1.8.0_sr8.25-150000.3.89.1 | 1.8.0_sr8.25-150000.3.89.1 |
java-1_8_0-ibmSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 6 CVEs |
before 1.8.0_sr8.25-150000.3.89.1 | 1.8.0_sr8.25-150000.3.89.1 |
java-1_8_0-ibmSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 6 CVEs |
before 1.8.0_sr8.25-150000.3.89.1 | 1.8.0_sr8.25-150000.3.89.1 |
java-1_8_0-ibmSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 6 CVEs |
before 1.8.0_sr8.25-150000.3.89.1 | 1.8.0_sr8.25-150000.3.89.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 6 CVEs |
before 1.8.0_sr8.25-150000.3.89.1 | 1.8.0_sr8.25-150000.3.89.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 6 CVEs |
before 1.8.0_sr8.25-150000.3.89.1 | 1.8.0_sr8.25-150000.3.89.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 6 CVEs |
before 1.8.0_sr8.25-150000.3.89.1 | 1.8.0_sr8.25-150000.3.89.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 6 CVEs |
before 1.8.0_sr8.25-150000.3.89.1 | 1.8.0_sr8.25-150000.3.89.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 6 CVEs |
before 1.8.0_sr8.25-150000.3.89.1 | 1.8.0_sr8.25-150000.3.89.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 6 CVEs |
before 1.8.0_sr8.25-150000.3.89.1 | 1.8.0_sr8.25-150000.3.89.1 |
java-1_8_0-ibmSUSE:Enterprise Storage 7.1 From an advisory covering 6 CVEs |
before 1.8.0_sr8.25-150000.3.89.1 | 1.8.0_sr8.25-150000.3.89.1 |
java-1_8_0-ibmopenSUSE:Leap 15.5 From an advisory covering 6 CVEs |
before 1.8.0_sr8.25-150000.3.89.1 | 1.8.0_sr8.25-150000.3.89.1 |
java-1_8_0-ibmopenSUSE:Leap 15.6 From an advisory covering 6 CVEs |
before 1.8.0_sr8.25-150000.3.89.1 | 1.8.0_sr8.25-150000.3.89.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-38264 is a medium vulnerability (CVSS 5.9) in Ibm Sdk, Java Technology Edition, published May 10, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.85%, the 58th percentile. Fixed in java-1.8.0-ibm 1:1.8.0.8.25-1.el8_10.
References
ibm.com/support/pages/node/7150727
exchange.xforce.ibmcloud.com/vulnerabilities/260578
nvd.nist.gov/vuln/detail/CVE-2023-38264
github.com/advisories/GHSA-p7p5-3hmf-xx69
access.redhat.com/errata/RHSA-2024:3685
Show 23 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2279963
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3685.json
cve.org/CVERecord?id=CVE-2023-38264
suse.com/support/update/announcement/2024/suse-su-20241845-1
bugzilla.suse.com/1222979