CVE-2026-71054
Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle...
Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u511. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u511. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
- Record
CVE-2026-71054- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-66711
Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u511. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
- Record
EUVD-2026-66711- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9wxj-fccf-76pg
Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle...
Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u511. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
- Record
GHSA-9wxj-fccf-76pg- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u511. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
- Record
CVE-2026-71054- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVSUSE-SU-2026:4107-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
Update to Java 8.0 Service Refresh 8 Fix Pack 71 (bsc#1277833):
- CVE-2026-8400: flaw in the ORB component may allow a malicious IIOP server to induce loading and instantation of arbitrary classes (bsc#1274276).
- CVE-2026-16243:
arraycmpSIMD implementation for Z and P does not check if the number of bytes to compare is zero (bsc#1274275). - CVE-2026-16440: a crafted .class file with deeply nested annotations causes a segmentation fault (bsc#1275779).
- CVE-2026-60589: OpenJDK: Improve Resource Resolving (bsc#1275777).
- CVE-2026-61308: OpenJDK: Enhance HTTP Connections (bsc#1275778).
- CVE-2026-70906: OpenJDK: Improve font loading (bsc#1275763).
- CVE-2026-70907: OpenJDK: Enhance TLS server (bsc#1275764).
- CVE-2026-71054: Vulnerability in Oracle Java SE (component: 2D) (bsc#1277019).
- Oracle August 18 2026 CSPU and IBM Security Update August 2026 (bsc#1277833).
- Record
SUSE-SU-2026:4107-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4153-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
Update to Java 8.0 Service Refresh 8 Fix Pack 71 (bsc#1277833):
- CVE-2026-8400: flaw in the ORB component may allow a malicious IIOP server to induce loading and instantation of arbitrary classes (bsc#1274276).
- CVE-2026-16243:
arraycmpSIMD implementation for Z and P does not check if the number of bytes to compare is zero (bsc#1274275). - CVE-2026-16440: a crafted .class file with deeply nested annotations causes a segmentation fault (bsc#1275779).
- CVE-2026-60589: OpenJDK: Improve Resource Resolving (bsc#1275777).
- CVE-2026-61308: OpenJDK: Enhance HTTP Connections (bsc#1275778).
- CVE-2026-70906: OpenJDK: Improve font loading (bsc#1275763).
- CVE-2026-70907: OpenJDK: Enhance TLS server (bsc#1275764).
- CVE-2026-71054: Vulnerability in Oracle Java SE (component: 2D) (bsc#1277019).
- Oracle August 18 2026 CSPU and IBM Security Update August 2026 (bsc#1277833).
- Record
SUSE-SU-2026:4153-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 8 CVEs |
before 1.8.0_sr8.71-30.156.1 | 1.8.0_sr8.71-30.156.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 8 CVEs |
before 1.8.0_sr8.71-30.156.1 | 1.8.0_sr8.71-30.156.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Module for Legacy 15 SP7 From an advisory covering 8 CVEs |
before 1.8.0_sr8.71-150000.3.125.1 | 1.8.0_sr8.71-150000.3.125.1 |
java-1_8_0-ibmSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 8 CVEs |
before 1.8.0_sr8.71-150000.3.125.1 | 1.8.0_sr8.71-150000.3.125.1 |
java-1_8_0-ibmSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 8 CVEs |
before 1.8.0_sr8.71-150000.3.125.1 | 1.8.0_sr8.71-150000.3.125.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 8 CVEs |
before 1.8.0_sr8.71-150000.3.125.1 | 1.8.0_sr8.71-150000.3.125.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 8 CVEs |
before 1.8.0_sr8.71-150000.3.125.1 | 1.8.0_sr8.71-150000.3.125.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 8 CVEs |
before 1.8.0_sr8.71-150000.3.125.1 | 1.8.0_sr8.71-150000.3.125.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 8 CVEs |
before 1.8.0_sr8.71-150000.3.125.1 | 1.8.0_sr8.71-150000.3.125.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 8 CVEs |
before 1.8.0_sr8.71-150000.3.125.1 | 1.8.0_sr8.71-150000.3.125.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 8 CVEs |
before 1.8.0_sr8.71-150000.3.125.1 | 1.8.0_sr8.71-150000.3.125.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-71054 is a medium vulnerability (CVSS 6.5) in Oracle Corporation Java Se, published August 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. No source names a fixed version.
References
support.oracle.com/support?documentId=CPU330
nvd.nist.gov/vuln/detail/CVE-2026-71054
github.com/advisories/GHSA-9wxj-fccf-76pg
suse.com/support/update/announcement/2026/suse-su-20264107-1
bugzilla.suse.com/1274275
Show 16 moreShow less