CVE-2024-20954
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle...
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
- Record
CVE-2024-20954- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
EUVDEUVD-2024-18668
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
- Record
EUVD-2024-18668- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3q44-44h8-2hgc
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle...
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
- Record
GHSA-3q44-44h8-2hgc- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
NVD
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
- Record
CVE-2024-20954- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVALPINE-CVE-2024-20954
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
- Record
ALPINE-CVE-2024-20954- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
OSV
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
- Record
CVE-2024-20954- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2024:4079
Red Hat Security Advisory: [23.1] Security update for the 23.1 release (RPMs)
- Record
RHSA-2024:4079- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVRHSA-2024:4081
Red Hat Security Advisory: [23.0] Security update for the 23.0 release (RPMs)
- Record
RHSA-2024:4081- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openjdk17Alpine:v3.17 |
before 17.0.11_p9-r0 | 17.0.11_p9-r0 |
openjdk17Alpine:v3.18 |
before 17.0.11_p9-r0 | 17.0.11_p9-r0 |
openjdk17Alpine:v3.19 |
before 17.0.11_p9-r0 | 17.0.11_p9-r0 |
openjdk17Alpine:v3.20 |
before 17.0.11_p9-r0 | 17.0.11_p9-r0 |
openjdk17Alpine:v3.21 |
before 17.0.11_p9-r0 | 17.0.11_p9-r0 |
openjdk17Alpine:v3.22 |
before 17.0.11_p9-r0 | 17.0.11_p9-r0 |
openjdk17Alpine:v3.23 |
before 17.0.11_p9-r0 | 17.0.11_p9-r0 |
openjdk17Alpine:v3.24 |
before 17.0.11_p9-r0 | 17.0.11_p9-r0 |
openjdk21Alpine:v3.19 |
before 21.0.3_p9-r0 | 21.0.3_p9-r0 |
openjdk21Alpine:v3.20 |
before 21.0.3_p9-r0 | 21.0.3_p9-r0 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openjdk21Alpine:v3.21 |
before 21.0.3_p9-r0 | 21.0.3_p9-r0 |
openjdk21Alpine:v3.22 |
before 21.0.3_p9-r0 | 21.0.3_p9-r0 |
openjdk21Alpine:v3.23 |
before 21.0.3_p9-r0 | 21.0.3_p9-r0 |
openjdk21Alpine:v3.24 |
before 21.0.3_p9-r0 | 21.0.3_p9-r0 |
quarkus-mandrel-javaRed Hat:quarkus:3.8::el8 From an advisory covering 2 CVEs |
before 0:23.1.3.1_1-13.redhat_00001.1.el8qks | 0:23.1.3.1_1-13.redhat_00001.1.el8qks |
quarkus-mandrel-java-jdk-21-bindingRed Hat:quarkus:3.8::el8 From an advisory covering 2 CVEs |
before 0:23.1.3.1_1-13.redhat_00001.1.el8qks | 0:23.1.3.1_1-13.redhat_00001.1.el8qks |
quarkus-mandrel-javaRed Hat:quarkus:3.2::el8 From an advisory covering 2 CVEs |
before 0:23.0.4.1_1-10.redhat_00001.1.el8qks | 0:23.0.4.1_1-10.redhat_00001.1.el8qks |
quarkus-mandrel-java-jdk-17-bindingRed Hat:quarkus:3.2::el8 From an advisory covering 2 CVEs |
before 0:23.0.4.1_1-10.redhat_00001.1.el8qks | 0:23.0.4.1_1-10.redhat_00001.1.el8qks |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-20954 is a low vulnerability (CVSS 3.7) in Oracle Graalvm, published April 16, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 44th percentile. Fixed in openjdk17 17.0.11_p9-r0.
References
oracle.com/security-alerts/cpuapr2024.html
nvd.nist.gov/vuln/detail/CVE-2024-20954
github.com/advisories/GHSA-3q44-44h8-2hgc
security.alpinelinux.org/vuln/CVE-2024-20954
access.redhat.com/errata/RHSA-2024:4079
Show 10 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2278636
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4079.json
cve.org/CVERecord?id=CVE-2024-20954