{"id":"CVE-2023-38264","aliases":["EUVD-2023-42084","GHSA-p7p5-3hmf-xx69","RHSA-2024:3685","RHSA-2024:4160","SUSE-SU-2024:1845-1","SUSE-SU-2024:1859-1"],"status":"published","title":"IBM SDK, Java Technology Edition denial of service","description":"The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21 is vulnerable to a denial of service attack in some circumstances due to improper enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters.  IBM X-Force ID:  260578.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00848,"percentile":0.58363,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2024-05-10T17:21:51Z","modified":"2026-06-29T10:59:07Z","fixes":[{"ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm","fixed_in":["1:1.8.0.8.25-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-demo","fixed_in":["1:1.8.0.8.25-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-devel","fixed_in":["1:1.8.0.8.25-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-headless","fixed_in":["1:1.8.0.8.25-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-jdbc","fixed_in":["1:1.8.0.8.25-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-plugin","fixed_in":["1:1.8.0.8.25-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-src","fixed_in":["1:1.8.0.8.25-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-webstart","fixed_in":["1:1.8.0.8.25-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm","fixed_in":["1:1.8.0.8.25-1jpp.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-demo","fixed_in":["1:1.8.0.8.25-1jpp.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-devel","fixed_in":["1:1.8.0.8.25-1jpp.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-jdbc","fixed_in":["1:1.8.0.8.25-1jpp.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-plugin","fixed_in":["1:1.8.0.8.25-1jpp.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-src","fixed_in":["1:1.8.0.8.25-1jpp.1.el7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.25-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.25-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.25-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.25-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.25-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.25-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.25-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-webstart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.25-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.25-1jpp.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.25-1jpp.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.25-1jpp.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.25-1jpp.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.25-1jpp.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.8.25-1jpp.1.el7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.25-30.123.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.25-30.123.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.25-30.123.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.25-150000.3.89.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP6","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.25-150000.3.89.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.25-150000.3.89.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.25-150000.3.89.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.25-150000.3.89.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.25-150000.3.89.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.25-150000.3.89.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.25-150000.3.89.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.25-150000.3.89.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.25-150000.3.89.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.25-150000.3.89.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.25-150000.3.89.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.25-150000.3.89.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.25-150000.3.89.1"}]}],"bundled":6}],"products":[{"vendor":"ibm","product":"java_software_development_kit"},{"vendor":"ibm","product":"sdk, java technology edition"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7150727","tags":["vendor-advisory","x_transferred","Vendor Advisory","article"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/260578","tags":["vdb-entry","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38264","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p7p5-3hmf-xx69"},{"url":"https://access.redhat.com/errata/RHSA-2024:3685","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2279963","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3685.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-38264","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38264","tags":["advisory"]},{"url":"https://www.ibm.com/support/pages/apar/IX90196","tags":["article"]},{"url":"https://www.ibm.com/support/pages/java-sdk-security-vulnerabilities#IBM_Security_Update_May_2024","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4160","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4160.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241845-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1222979","tags":["report"]},{"url":"https://bugzilla.suse.com/1222983","tags":["report"]},{"url":"https://bugzilla.suse.com/1222984","tags":["report"]},{"url":"https://bugzilla.suse.com/1222986","tags":["report"]},{"url":"https://bugzilla.suse.com/1222987","tags":["report"]},{"url":"https://bugzilla.suse.com/1223470","tags":["report"]},{"url":"https://bugzilla.suse.com/1224164","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21094","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241859-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-38264","title":"IBM SDK, Java Technology Edition denial of service","description":"The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21 is vulnerable to a denial of service attack in some circumstances due to improper enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters.  IBM X-Force ID:  260578.","status":"published","published":"2024-05-10T17:21:51.076Z","modified":"2024-08-02T17:39:12.051Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:35:29.381004Z"}],"euvd":[{"id":"EUVD-2023-42084","description":"The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21 is vulnerable to a denial of service attack in some circumstances due to improper enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters.  IBM X-Force ID:  260578.","status":"published","published":"2024-05-10T17:21:51Z","modified":"2024-08-02T17:39:12Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T03:50:02.733403Z"}],"ghsa":[{"id":"GHSA-p7p5-3hmf-xx69","title":"The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8...","description":"The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21 is vulnerable to a denial of service attack in some circumstances due to improper enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters.  IBM X-Force ID:  260578.","status":"published","published":"2024-05-14T15:32:50Z","modified":"2024-05-14T15:33:04Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:57:20.80512Z"}],"nvd":[{"id":"CVE-2023-38264","description":"The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21 is vulnerable to a denial of service attack in some circumstances due to improper enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters.  IBM X-Force ID:  260578.","status":"published","published":"2024-05-14T13:21:29.417Z","modified":"2026-06-17T06:09:47.207Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:09:15.329996Z"}],"osv":[{"id":"RHSA-2024:3685","title":"Red Hat Security Advisory: java-1.8.0-ibm security update","status":"published","published":"2024-09-13T19:10:31Z","modified":"2026-06-29T10:58:44Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:4160","title":"Red Hat Security Advisory: java-1.8.0-ibm security update","status":"published","published":"2024-09-13T19:09:32Z","modified":"2026-06-29T10:59:07Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"SUSE-SU-2024:1845-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\nUpdate to Java 8.0 Service Refresh 8 Fix Pack 25 (bsc#1223470):\n\n- CVE-2023-38264: Fixed Object Request Broker (ORB) denial of service (bsc#1224164). \n- CVE-2024-21094: Fixed C2 compilation fails with 'Exceeded _node_regs array' (bsc#1222986). \n- CVE-2024-21068: Fixed integer overflow in C1 compiler address generation (bsc#1222983). \n- CVE-2024-21085: Fixed Pack200 excessive memory allocation (bsc#1222984).\n- CVE-2024-21011: Fixed Long Exception message leading to crash (bsc#1222979). \n- CVE-2024-21012: Fixed HTTP/2 client improper reverse DNS lookup (bsc#1222987). \n","status":"published","published":"2024-05-29T19:41:10Z","modified":"2025-05-02T04:35:11.554133Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1859-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\nUpdate to Java 8.0 Service Refresh 8 Fix Pack 25 (bsc#1223470):\n\n- CVE-2023-38264: Fixed Object Request Broker (ORB) denial of service (bsc#1224164).\n- CVE-2024-21094: Fixed C2 compilation fails with 'Exceeded _node_regs array' (bsc#1222986).\n- CVE-2024-21068: Fixed integer overflow in C1 compiler address generation (bsc#1222983).\n- CVE-2024-21085: Fixed Pack200 excessive memory allocation (bsc#1222984).\n- CVE-2024-21011: Fixed Long Exception message leading to crash (bsc#1222979).\n- CVE-2024-21012: Fixed HTTP/2 client improper reverse DNS lookup (bsc#1222987).\n","status":"published","published":"2024-05-30T12:14:53Z","modified":"2026-02-04T03:52:46.714248Z","updated_at":"2026-11-02T15:53:54.652421Z"}]}}