{"id":"CVE-2021-2432","aliases":["ALPINE-CVE-2021-2432","BIT-java-2021-2432","BIT-java-min-2021-2432","BIT-jre-2021-2432","CLSA-2022-1661173656","CLSA-2022-1661176564","EUVD-2021-16891","GHSA-3xjg-p34v-7jgf","RHSA-2021:3293","SUSE-SU-2021:3007-1","SUSE-SU-2022:0166-1","SUSE-SU-2022:14875-1","SUSE-SU-2022:14876-1"],"status":"published","title":"Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version...","description":"Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version that is affected is Java SE: 7u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.03701,"percentile":0.8983,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-07-20T22:44:41Z","modified":"2026-11-03T06:32:32Z","fixes":[{"ecosystem":"Alpine:v3.15","package":"openjdk7","fixed_in":["7.311.2.6.27-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"openjdk7","fixed_in":["7.311.2.6.27-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"openjdk7","fixed_in":["7.311.2.6.27-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openjdk7","fixed_in":["7.311.2.6.27-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"java","fixed_in":["1.7.0","7.0.311"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"java-min","fixed_in":["1.7.0","7.0.311"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"jre","fixed_in":["1.7.0","7.0.311"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.15","package":"openjdk7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.311.2.6.27-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"openjdk7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.311.2.6.27-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openjdk7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.311.2.6.27-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openjdk7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.311.2.6.27-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"java","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.0"},{"introduced":"7.0.0"},{"fixed":"7.0.311"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"java-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.0"},{"introduced":"7.0.0"},{"fixed":"7.0.311"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"jre","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.0"},{"introduced":"7.0.0"},{"fixed":"7.0.311"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"java-1.7.0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0.351-2.6.28.0.el6.tuxcare.els1"}]}],"bundled":50},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"java-1.7.0-openjdk-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0.351-2.6.28.0.el6.tuxcare.els1"}]}],"bundled":50},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"java-1.7.0-openjdk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0.351-2.6.28.0.el6.tuxcare.els1"}]}],"bundled":50},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"java-1.7.0-openjdk-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0.351-2.6.28.0.el6.tuxcare.els1"}]}],"bundled":50},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"java-1.7.0-openjdk-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0.351-2.6.28.0.el6.tuxcare.els1"}]}],"bundled":50},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"java-1.7.0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0.351-2.6.28.0.el6.tuxcare.els1"}]}],"bundled":50},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"java-1.7.0-openjdk-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0.351-2.6.28.0.el6.tuxcare.els1"}]}],"bundled":50},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"java-1.7.0-openjdk-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0.351-2.6.28.0.el6.tuxcare.els1"}]}],"bundled":50},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"java-1.7.0-openjdk-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0.351-2.6.28.0.el6.tuxcare.els1"}]}],"bundled":50},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"java-1.7.0-openjdk-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.0.351-2.6.28.0.el6.tuxcare.els1"}]}],"bundled":50},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.90-1jpp.1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.90-1jpp.1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.90-1jpp.1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.90-1jpp.1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.90-1jpp.1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.4.90-1jpp.1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"java-1_7_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0.311-43.50.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"java-1_7_0-openjdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0.311-43.50.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-26.68.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"java-1_7_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0_sr11.0-65.63.1"}]}],"bundled":12}],"products":[{"vendor":"mcafee","product":"epolicy_orchestrator"},{"vendor":"oracle","product":"jdk"},{"vendor":"oracle corporation","product":"java se jdk and jre"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210723-0002/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10366","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202209-05","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-2432","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-3xjg-p34v-7jgf"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-2432","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2022-1661173656.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2022-1661176564.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3293","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1982874","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1982879","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994980","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3293.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-2341","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-2341","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-2341","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-2369","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-2369","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-2369","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-2432","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-2432","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213007-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1185055","tags":["report"]},{"url":"https://bugzilla.suse.com/1185056","tags":["report"]},{"url":"https://bugzilla.suse.com/1188564","tags":["report"]},{"url":"https://bugzilla.suse.com/1188565","tags":["report"]},{"url":"https://bugzilla.suse.com/1188568","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2432","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220166-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1191905","tags":["report"]},{"url":"https://bugzilla.suse.com/1191909","tags":["report"]},{"url":"https://bugzilla.suse.com/1191910","tags":["report"]},{"url":"https://bugzilla.suse.com/1191911","tags":["report"]},{"url":"https://bugzilla.suse.com/1191913","tags":["report"]},{"url":"https://bugzilla.suse.com/1191914","tags":["report"]},{"url":"https://bugzilla.suse.com/1192052","tags":["report"]},{"url":"https://bugzilla.suse.com/1194198","tags":["report"]},{"url":"https://bugzilla.suse.com/1194232","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41035","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-202214875-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-202214876-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188566","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2388","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-2432","description":"Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version that is affected is Java SE: 7u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2021-07-20T22:44:41Z","modified":"2024-09-25T19:44:47.488Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"updated_at":"2026-11-02T14:33:03.671751Z"}],"euvd":[{"id":"EUVD-2021-16891","description":"Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version that is affected is Java SE: 7u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2021-07-20T22:44:41Z","modified":"2024-09-25T19:44:47Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-03T00:28:10.832665Z"}],"ghsa":[{"id":"GHSA-3xjg-p34v-7jgf","title":"Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version...","description":"Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version that is affected is Java SE: 7u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2022-05-24T19:08:36Z","modified":"2023-01-28T05:06:59Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T14:44:29.269512Z"}],"nvd":[{"id":"CVE-2021-2432","description":"Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version that is affected is Java SE: 7u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2021-07-21T15:16:03.893Z","modified":"2026-06-17T03:49:29.99Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:56.185362Z"}],"osv":[{"id":"ALPINE-CVE-2021-2432","description":"Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version that is affected is Java SE: 7u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2021-07-21T15:16:03.893Z","modified":"2026-11-03T06:32:32.101431739Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"RHSA-2021:3293","title":"Red Hat Security Advisory: java-1.7.1-ibm security update","status":"published","published":"2024-09-13T20:29:36Z","modified":"2026-06-29T10:36:45Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"BIT-java-2021-2432","description":"Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version that is affected is Java SE: 7u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2026-05-06T14:42:29.378Z","modified":"2026-09-08T08:48:23.581684096Z","updated_at":"2026-11-02T15:28:31.42203Z"},{"id":"BIT-java-min-2021-2432","description":"Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version that is affected is Java SE: 7u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2026-05-06T14:42:31.695Z","modified":"2026-09-08T08:47:54.719416674Z","updated_at":"2026-11-02T15:28:31.42203Z"},{"id":"BIT-jre-2021-2432","description":"Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version that is affected is Java SE: 7u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).","status":"published","published":"2026-05-08T05:43:56.704Z","modified":"2026-09-08T08:48:03.901787395Z","updated_at":"2026-11-02T15:28:31.782692Z"},{"id":"CLSA-2022-1661173656","title":"Fixed 50 CVEs in java-1.7.0-openjdk","description":"- Bump to 2.6.28 and OpenJDK 7u351-b01.\n- Security fixes in 7u351:\n - CVE-2022-21540: Improve class compilation (JDK-8281859)\n - CVE-2022-21541: Enhance MethodHandle invocations (JDK-8281866)\n - CVE-2022-34169: Improve Xalan supports (JDK-8285407)\n- Security fixes in 7u341:\n - CVE-2022-21426: Better XPath expression handling (JDK-8270504)\n - CVE-2022-21434: Better invocation handler handling (JDK-8277672)\n - CVE-2022-21443: Improved Object Identification (JDK-8275151)\n - CVE-2022-21476: Improve Santuario processing (JDK-8278008)\n - CVE-2022-21496: Improve URL supports (JDK-8278972)\n- Security fixes in 7u331:\n - CVE-2022-21248: Enhance cross VM serialization (JDK-8264934)\n - CVE-2022-21282: Better resolution of URIs (JDK-8270492)\n - CVE-2022-21283: Better String matching (JDK-8268813)\n - CVE-2022-21293: Improve String constructions (JDK-8270392)\n - CVE-2022-21294: Enhance construction of Identity maps (JDK-8270416)\n - CVE-2022-21296: Improve SAX Parser configuration management (JDK-8270498)\n - CVE-2022-21299: Improved scanning of XML entities (JDK-8270646)\n - CVE-2022-21305: Better array indexing (JDK-8272014)\n - CVE-2022-21340: Verify Jar Verification (JDK-8272026)\n - CVE-2022-21341: Improve serial forms for transport (JDK-8272236)\n - CVE-2022-21349: Improve Solaris font rendering (JDK-8273748)\n - CVE-2022-21360: Enhance BMP image support (JDK-8273756)\n - CVE-2022-21365: Enhanced BMP processing (JDK-8273838)\n- Security fixes in 7u321:\n - CVE-2021-35550: Update the default enabled cipher suites preference\n   (JDK-8163326)\n - CVE-2021-35556: Richer Text Editors (JDK-8265167)\n - CVE-2021-35559: Enhanced style for RTF kit (JDK-8265580)\n - CVE-2021-35561: Better hashing support (JDK-8266097)\n - CVE-2021-35564: Improve Keystore integrity (JDK-8266137)\n - CVE-2021-35565: com.sun.net.HttpsServer spins on TLS session close\n   (JDK-8254967)\n - CVE-2021-35586: Better BMP support (JDK-8267735)\n - CVE-2021-35588: InnerClasses: VM permits wrong Throw ClassFormatError if\n   InnerClasses attribute's inner_class_info_index is 0 (JDK-8130183)\n - CVE-2021-35603: Better session identification (JDK-8269618)\n- Security fixes in 7u311:\n - CVE-2021-2341: Improve file transfers (JDK-8258432)\n - CVE-2021-2369: Better jar file validation (JDK-8260967)\n - CVE-2021-2432: Provide better LDAP provider support (JDK-8267412)\n- Security fixes in 7u301:\n - CVE-2021-2161: Less ambiguous processing (JDK-8250568)\n - CVE-2021-2163: Enhance opening JARs (JDK-8249906)\n- Security fixes in 7u281:\n - CVE-2020-14779: Enhance support of Proxy class (JDK-8236862)\n - CVE-2020-14781: Enhanced LDAP contexts (JDK-8237990)\n - CVE-2020-14782: Enhance certificate processing (JDK-8237995)\n - CVE-2020-14792: Better range handling (JDK-8241114)\n - CVE-2020-14796: Improved URI Support (JDK-8242680)\n - CVE-2020-14797: Better Path Validation (JDK-8242685)\n - CVE-2020-14798: Enhanced buffer support (JDK-8242695)\n - CVE-2020-14803: Improved Buffer supports (JDK-8244136)\n- Security fixes in 7u271:\n - CVE-2020-14577: Enhance certificate verification (JDK-8237592)\n - CVE-2020-14578: NegativeArraySizeException in\n   sun.security.util.DerInputStream.getUnalignedBitString() (JDK-8028591)\n - CVE-2020-14579: NullPointerException in DerValue.equals(DerValue)\n   (JDK-8028431)\n - CVE-2020-14581: Better matrix operations (JDK-8238002)\n - CVE-2020-14583: Better Buffer support (JDK-8238920)\n - CVE-2020-14593: Less Affine Transformations (JDK-8240119)\n - CVE-2020-14621: Better XML namespace handling (JDK-8242136)\n- Update tzdata requirement to 2022a to match JDK-8283350\n- Update NEWS from IcedTea\n- Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after\n  bump OpenJDK version","status":"published","published":"2022-08-22T13:07:36Z","modified":"2026-10-21T10:48:01.408185448Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1661176564","title":"Fixed 50 CVEs in java-1.7.0-openjdk","description":"- Bump to 2.6.28 and OpenJDK 7u351-b01.\n- Security fixes in 7u351:\n - CVE-2022-21540: Improve class compilation (JDK-8281859)\n - CVE-2022-21541: Enhance MethodHandle invocations (JDK-8281866)\n - CVE-2022-34169: Improve Xalan supports (JDK-8285407)\n- Security fixes in 7u341:\n - CVE-2022-21426: Better XPath expression handling (JDK-8270504)\n - CVE-2022-21434: Better invocation handler handling (JDK-8277672)\n - CVE-2022-21443: Improved Object Identification (JDK-8275151)\n - CVE-2022-21476: Improve Santuario processing (JDK-8278008)\n - CVE-2022-21496: Improve URL supports (JDK-8278972)\n- Security fixes in 7u331:\n - CVE-2022-21248: Enhance cross VM serialization (JDK-8264934)\n - CVE-2022-21282: Better resolution of URIs (JDK-8270492)\n - CVE-2022-21283: Better String matching (JDK-8268813)\n - CVE-2022-21293: Improve String constructions (JDK-8270392)\n - CVE-2022-21294: Enhance construction of Identity maps (JDK-8270416)\n - CVE-2022-21296: Improve SAX Parser configuration management (JDK-8270498)\n - CVE-2022-21299: Improved scanning of XML entities (JDK-8270646)\n - CVE-2022-21305: Better array indexing (JDK-8272014)\n - CVE-2022-21340: Verify Jar Verification (JDK-8272026)\n - CVE-2022-21341: Improve serial forms for transport (JDK-8272236)\n - CVE-2022-21349: Improve Solaris font rendering (JDK-8273748)\n - CVE-2022-21360: Enhance BMP image support (JDK-8273756)\n - CVE-2022-21365: Enhanced BMP processing (JDK-8273838)\n- Security fixes in 7u321:\n - CVE-2021-35550: Update the default enabled cipher suites preference\n   (JDK-8163326)\n - CVE-2021-35556: Richer Text Editors (JDK-8265167)\n - CVE-2021-35559: Enhanced style for RTF kit (JDK-8265580)\n - CVE-2021-35561: Better hashing support (JDK-8266097)\n - CVE-2021-35564: Improve Keystore integrity (JDK-8266137)\n - CVE-2021-35565: com.sun.net.HttpsServer spins on TLS session close\n   (JDK-8254967)\n - CVE-2021-35586: Better BMP support (JDK-8267735)\n - CVE-2021-35588: InnerClasses: VM permits wrong Throw ClassFormatError if\n   InnerClasses attribute's inner_class_info_index is 0 (JDK-8130183)\n - CVE-2021-35603: Better session identification (JDK-8269618)\n- Security fixes in 7u311:\n - CVE-2021-2341: Improve file transfers (JDK-8258432)\n - CVE-2021-2369: Better jar file validation (JDK-8260967)\n - CVE-2021-2432: Provide better LDAP provider support (JDK-8267412)\n- Security fixes in 7u301:\n - CVE-2021-2161: Less ambiguous processing (JDK-8250568)\n - CVE-2021-2163: Enhance opening JARs (JDK-8249906)\n- Security fixes in 7u281:\n - CVE-2020-14779: Enhance support of Proxy class (JDK-8236862)\n - CVE-2020-14781: Enhanced LDAP contexts (JDK-8237990)\n - CVE-2020-14782: Enhance certificate processing (JDK-8237995)\n - CVE-2020-14792: Better range handling (JDK-8241114)\n - CVE-2020-14796: Improved URI Support (JDK-8242680)\n - CVE-2020-14797: Better Path Validation (JDK-8242685)\n - CVE-2020-14798: Enhanced buffer support (JDK-8242695)\n - CVE-2020-14803: Improved Buffer supports (JDK-8244136)\n- Security fixes in 7u271:\n - CVE-2020-14577: Enhance certificate verification (JDK-8237592)\n - CVE-2020-14578: NegativeArraySizeException in\n   sun.security.util.DerInputStream.getUnalignedBitString() (JDK-8028591)\n - CVE-2020-14579: NullPointerException in DerValue.equals(DerValue)\n   (JDK-8028431)\n - CVE-2020-14581: Better matrix operations (JDK-8238002)\n - CVE-2020-14583: Better Buffer support (JDK-8238920)\n - CVE-2020-14593: Less Affine Transformations (JDK-8240119)\n - CVE-2020-14621: Better XML namespace handling (JDK-8242136)\n- Update tzdata requirement to 2022a to match JDK-8283350\n- Update NEWS from IcedTea\n- Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after\n  bump OpenJDK version","status":"published","published":"2022-08-22T13:56:04Z","modified":"2026-10-21T10:47:13.375639364Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"SUSE-SU-2021:3007-1","title":"Security update for java-1_7_0-openjdk","description":"This update for java-1_7_0-openjdk fixes the following issues:\n\n- Update to 2.6.27 - OpenJDK 7u311 (July 2021 CPU)\n\nSecurity fixes:\n\n- CVE-2021-2341: Improve file transfers (bsc#1188564)\n- CVE-2021-2369: Better jar file validation (bsc#1188565)\n- CVE-2021-2432: Provide better LDAP provider support (bsc#1188568)\n- CVE-2021-2163: Enhance opening JARs (bsc#1185055)\n- CVE-2021-2161: Less ambiguous processing (bsc#1185056)\n- CVE-2018-3639: Fix revision to prefer\n","status":"published","published":"2021-09-09T13:22:06Z","modified":"2026-02-04T04:35:59.369073Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2022:0166-1","title":"Security update for java-1_7_1-ibm","description":"This update for java-1_7_1-ibm fixes the following issues:\n\n- Update to Java 7.1 Service Refresh 5 Fix Pack 0\n- CVE-2021-41035: before version 0.29.0, the openj9 JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods. (bsc#1194198, bsc#1192052)\n- CVE-2021-35586: Excessive memory allocation in BMPImageReader. (bsc#1191914)\n- CVE-2021-35564: Certificates with end dates too far in the future can corrupt keystore. (bsc#1191913)\n- CVE-2021-35559: Excessive memory allocation in RTFReader. (bsc#1191911)\n- CVE-2021-35556: Excessive memory allocation in RTFParser. (bsc#1191910)\n- CVE-2021-35565: Loop in HttpsServer triggered during TLS session close. (bsc#1191909) \n- CVE-2021-35588: Incomplete validation of inner class references in ClassFileParser. (bsc#1191905)\n- CVE-2021-2341: Fixed a flaw inside the FtpClient. (bsc#1188564)\n- CVE-2021-2369: JAR file handling problem containing multiple MANIFEST.MF files. (bsc#1188565)\n- CVE-2021-2432: Fixed a vulnerability in the omponent JNDI. (bsc#1188568)\n- CVE-2021-2163: Incomplete enforcement of JAR signing disabled algorithms. (bsc#1185055)\n","status":"published","published":"2022-01-24T15:31:46Z","modified":"2026-02-04T02:31:56.802006Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:14875-1","title":"Security update for java-1_7_1-ibm","description":"This update for java-1_7_1-ibm fixes the following issues:\n\n- Update to Java 7.1 Service Refresh 5 Fix Pack 0\n- CVE-2021-41035: before version 0.29.0, the openj9 JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods. (bsc#1194198, bsc#1192052)\n- CVE-2021-35586: Excessive memory allocation in BMPImageReader. (bsc#1191914)\n- CVE-2021-35564: Certificates with end dates too far in the future can corrupt keystore. (bsc#1191913)\n- CVE-2021-35559: Excessive memory allocation in RTFReader. (bsc#1191911)\n- CVE-2021-35556: Excessive memory allocation in RTFParser. (bsc#1191910)\n- CVE-2021-35565: Loop in HttpsServer triggered during TLS session close. (bsc#1191909) \n- CVE-2021-35588: Incomplete validation of inner class references in ClassFileParser. (bsc#1191905)\n- CVE-2021-2341: Fixed a flaw inside the FtpClient. (bsc#1188564)\n- CVE-2021-2369: JAR file handling problem containing multiple MANIFEST.MF files. (bsc#1188565)\n- CVE-2021-2432: Fixed a vulnerability in the omponent JNDI. (bsc#1188568)\n- CVE-2021-2163: Incomplete enforcement of JAR signing disabled algorithms. (bsc#1185055)\n","status":"published","published":"2022-01-18T10:47:47Z","modified":"2026-02-04T03:37:21.593554Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:14876-1","title":"Security update for java-1_7_1-ibm","description":"This update for java-1_7_1-ibm fixes the following issues:\n\n- Update to Java 7.1 Service Refresh 5 Fix Pack 0\n- CVE-2021-41035: before version 0.29.0, the openj9 JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods. (bsc#1194198, bsc#1192052)\n- CVE-2021-35586: Excessive memory allocation in BMPImageReader. (bsc#1191914)\n- CVE-2021-35564: Certificates with end dates too far in the future can corrupt keystore. (bsc#1191913)\n- CVE-2021-35559: Excessive memory allocation in RTFReader. (bsc#1191911)\n- CVE-2021-35556: Excessive memory allocation in RTFParser. (bsc#1191910)\n- CVE-2021-35565: Loop in HttpsServer triggered during TLS session close. (bsc#1191909) \n- CVE-2021-35588: Incomplete validation of inner class references in ClassFileParser. (bsc#1191905)\n- CVE-2021-2341: Fixed a flaw inside the FtpClient. (bsc#1188564)\n- CVE-2021-2369: JAR file handling problem containing multiple MANIFEST.MF files. (bsc#1188565)\n- CVE-2021-2432: Fixed a vulnerability in the omponent JNDI. (bsc#1188568)\n- CVE-2021-2163: Incomplete enforcement of JAR signing disabled algorithms. (bsc#1185055)\n- CVE-2021-2388: Fixed a flaw inside the Hotspot component performed range check elimination. (bsc#1188566)\n","status":"published","published":"2022-01-18T13:28:58Z","modified":"2026-02-04T02:17:09.192265Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}