{"id":"CVE-2026-101737","aliases":["DEBIAN-CVE-2026-101737","EUVD-2026-106138","GHSA-hfx2-9rhx-p468","UBUNTU-CVE-2026-101737"],"status":"published","title":"Vulnerability in Oracle Java SE (component: Compiler).   The supported version that is affected...","description":"Vulnerability in Oracle Java SE (component: Compiler).   The supported version that is affected is Oracle Java SE: 26.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00456,"percentile":0.39824,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2026-10-20T21:22:36Z","modified":"2026-11-10T02:50:20Z","fixes":[{"ecosystem":"Ubuntu:26.10","package":"openjdk-27","fixed_in":["27.0.1.0.3+1-1~26.10.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:14","package":"openjdk-27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["27+35-1","27+35-2","27.0.1+9-1","27.0.1.0.2+1-1","27.0.1.0.3+1-1","27~10ea-1","27~13ea-1","27~13ea-2","27~17ea-1","27~17ea-2","27~18ea-1","27~18ea-2~exp1","27~18ea-2~exp2","27~19ea-1","27~23ea-1","27~24ea-1","27~24ea-2","27~30ea-1","27~33ea-1","27~34ea-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openjdk-27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.0.1.0.3+1-1~26.10.1"}]}],"versions":["27~19ea-1","27~34ea-1","27+35-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openjdk-26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["26~17ea-1","26~26ea-1","26~28ea-1","26~30ea-1","26~32ea-1","26~34ea-1","26.0.1+8-2~26.04.2","26.0.2+10-2~26.04.2"]}],"products":[{"vendor":"oracle corporation","product":"oracle java se"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101737"},{"url":"https://github.com/advisories/GHSA-hfx2-9rhx-p468"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-101737","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-101737","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-101737","tags":["report"]},{"url":"https://openjdk.org/groups/vulnerability/advisories/2026-10-20","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-9005-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-101737","description":"Vulnerability in Oracle Java SE (component: Compiler).   The supported version that is affected is Oracle Java SE: 26.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).","status":"published","published":"2026-10-20T21:22:36.614Z","modified":"2026-10-22T17:33:26.985Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:20:09.808851Z"}],"euvd":[{"id":"EUVD-2026-106138","description":"Vulnerability in Oracle Java SE (component: Compiler).   The supported version that is affected is Oracle Java SE: 26.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).","status":"published","published":"2026-10-20T21:22:36Z","modified":"2026-10-22T17:33:26Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:59:34.378575Z"}],"ghsa":[{"id":"GHSA-hfx2-9rhx-p468","title":"Vulnerability in Oracle Java SE (component: Compiler).   The supported version that is affected...","description":"Vulnerability in Oracle Java SE (component: Compiler).   The supported version that is affected is Oracle Java SE: 26.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).","status":"published","published":"2026-10-21T00:32:28Z","modified":"2026-10-22T18:38:48Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:14:16.352322Z"}],"nvd":[{"id":"CVE-2026-101737","description":"Vulnerability in Oracle Java SE (component: Compiler).   The supported version that is affected is Oracle Java SE: 26.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).","status":"published","published":"2026-10-20T22:18:28.643Z","modified":"2026-10-22T18:17:17.98Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:13:01.463896Z"}],"osv":[{"id":"DEBIAN-CVE-2026-101737","description":"Vulnerability in Oracle Java SE (component: Compiler).   The supported version that is affected is Oracle Java SE: 26.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).","status":"published","published":"2026-10-20T22:18:28.643Z","modified":"2026-11-02T22:00:06.269989357Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:03:07.015763Z"},{"id":"UBUNTU-CVE-2026-101737","description":"Vulnerability in Oracle Java SE (component: Compiler).   The supported version that is affected is Oracle Java SE: 26.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).","status":"published","published":"2026-10-20T22:18:00Z","modified":"2026-11-10T02:50:20.145955562Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-10T03:18:57.092165Z"}]}}