{"id":"CVE-2026-71054","aliases":["EUVD-2026-66711","GHSA-9wxj-fccf-76pg","SUSE-SU-2026:4107-1","SUSE-SU-2026:4153-1"],"status":"published","title":"Vulnerability in Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle...","description":"Vulnerability in Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 7u511. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00366,"percentile":0.30697,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-770"],"published":"2026-08-26T19:57:04Z","modified":"2026-09-15T17:00:05Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.71-30.156.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.71-30.156.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.71-150000.3.125.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.71-150000.3.125.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.71-150000.3.125.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.71-150000.3.125.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.71-150000.3.125.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.71-150000.3.125.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.71-150000.3.125.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.71-150000.3.125.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.71-150000.3.125.1"}]}],"bundled":8}],"products":[{"vendor":"oracle corporation","product":"oracle java se"}],"references":[{"url":"https://support.oracle.com/support/?documentId=CPU330","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71054"},{"url":"https://github.com/advisories/GHSA-9wxj-fccf-76pg"},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264107-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1274275","tags":["report"]},{"url":"https://bugzilla.suse.com/1274276","tags":["report"]},{"url":"https://bugzilla.suse.com/1275763","tags":["report"]},{"url":"https://bugzilla.suse.com/1275764","tags":["report"]},{"url":"https://bugzilla.suse.com/1275777","tags":["report"]},{"url":"https://bugzilla.suse.com/1275778","tags":["report"]},{"url":"https://bugzilla.suse.com/1275779","tags":["report"]},{"url":"https://bugzilla.suse.com/1277019","tags":["report"]},{"url":"https://bugzilla.suse.com/1277833","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-70907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8400","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264153-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-71054","description":"Vulnerability in Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 7u511. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).","status":"published","published":"2026-08-26T19:57:04.287Z","modified":"2026-08-26T20:25:09.364Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-66711","description":"Vulnerability in Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 7u511. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).","status":"published","published":"2026-08-26T19:57:04Z","modified":"2026-08-26T20:25:09Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:01:29.296861Z"}],"ghsa":[{"id":"GHSA-9wxj-fccf-76pg","title":"Vulnerability in Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle...","description":"Vulnerability in Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 7u511. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).","status":"published","published":"2026-08-26T21:31:44Z","modified":"2026-08-26T21:31:52Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:11:01.362113Z"}],"nvd":[{"id":"CVE-2026-71054","description":"Vulnerability in Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 7u511. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).","status":"published","published":"2026-08-26T20:17:58.897Z","modified":"2026-08-28T21:16:15.74Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:41.66469Z"}],"osv":[{"id":"SUSE-SU-2026:4107-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\nUpdate to Java 8.0 Service Refresh 8 Fix Pack 71 (bsc#1277833):\n\n- CVE-2026-8400: flaw in the ORB component may allow a malicious IIOP server to induce loading and instantation of\n  arbitrary classes (bsc#1274276).\n- CVE-2026-16243: `arraycmp` SIMD implementation for Z and P does not check if the number of bytes to compare is zero\n  (bsc#1274275).\n- CVE-2026-16440: a crafted .class file with deeply nested annotations causes a segmentation fault (bsc#1275779).\n- CVE-2026-60589: OpenJDK: Improve Resource Resolving (bsc#1275777).\n- CVE-2026-61308: OpenJDK: Enhance HTTP Connections (bsc#1275778).\n- CVE-2026-70906: OpenJDK: Improve font loading (bsc#1275763).\n- CVE-2026-70907: OpenJDK: Enhance TLS server (bsc#1275764).\n- CVE-2026-71054: Vulnerability in Oracle Java SE (component: 2D) (bsc#1277019).\n- Oracle August 18 2026 CSPU and IBM Security Update August 2026 (bsc#1277833).\n","status":"published","published":"2026-09-09T13:24:53Z","modified":"2026-09-14T18:23:17.5955475Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4153-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\nUpdate to Java 8.0 Service Refresh 8 Fix Pack 71 (bsc#1277833):\n\n- CVE-2026-8400: flaw in the ORB component may allow a malicious IIOP server to induce loading and instantation of\n  arbitrary classes (bsc#1274276).\n- CVE-2026-16243: `arraycmp` SIMD implementation for Z and P does not check if the number of bytes to compare is zero\n  (bsc#1274275).\n- CVE-2026-16440: a crafted .class file with deeply nested annotations causes a segmentation fault (bsc#1275779).\n- CVE-2026-60589: OpenJDK: Improve Resource Resolving (bsc#1275777).\n- CVE-2026-61308: OpenJDK: Enhance HTTP Connections (bsc#1275778).\n- CVE-2026-70906: OpenJDK: Improve font loading (bsc#1275763).\n- CVE-2026-70907: OpenJDK: Enhance TLS server (bsc#1275764).\n- CVE-2026-71054: Vulnerability in Oracle Java SE (component: 2D) (bsc#1277019).\n- Oracle August 18 2026 CSPU and IBM Security Update August 2026 (bsc#1277833).\n","status":"published","published":"2026-09-14T08:05:15Z","modified":"2026-09-15T17:00:05.449909525Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}