Every CVESearch/Get API key

CVE-2021-41041

In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during...

5.3 Medium

CVE-2021-41041 is a medium vulnerability (CVSS 5.3) in Eclipse Openj9, published April 27, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.08%, the 65th percentile. No source names a fixed version.

What does this mean?
Severity
5.3 MediumCVSS 3.1, NVD
Exploit chance
1.08%EPSS, 65th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

1.08%Up 0.2 points since Apr 27, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
java-1.8.0-ibm
Red Hat:rhel_extras:7
From an advisory covering 5 CVEs
before 1:1.8.0.7.10-1jpp.1.el7
1:1.8.0.7.10-1jpp.1.el7
java-1.8.0-ibm-demo
Red Hat:rhel_extras:7
From an advisory covering 5 CVEs
before 1:1.8.0.7.10-1jpp.1.el7
1:1.8.0.7.10-1jpp.1.el7
java-1.8.0-ibm-devel
Red Hat:rhel_extras:7
From an advisory covering 5 CVEs
before 1:1.8.0.7.10-1jpp.1.el7
1:1.8.0.7.10-1jpp.1.el7
java-1.8.0-ibm-jdbc
Red Hat:rhel_extras:7
From an advisory covering 5 CVEs
before 1:1.8.0.7.10-1jpp.1.el7
1:1.8.0.7.10-1jpp.1.el7
java-1.8.0-ibm-plugin
Red Hat:rhel_extras:7
From an advisory covering 5 CVEs
before 1:1.8.0.7.10-1jpp.1.el7
1:1.8.0.7.10-1jpp.1.el7
java-1.8.0-ibm-src
Red Hat:rhel_extras:7
From an advisory covering 5 CVEs
before 1:1.8.0.7.10-1jpp.1.el7
1:1.8.0.7.10-1jpp.1.el7
java-1.8.0-ibm
Red Hat:enterprise_linux:8::supplementary
From an advisory covering 5 CVEs
before 1:1.8.0.7.10-1.el8_6
1:1.8.0.7.10-1.el8_6
java-1.8.0-ibm-demo
Red Hat:enterprise_linux:8::supplementary
From an advisory covering 5 CVEs
before 1:1.8.0.7.10-1.el8_6
1:1.8.0.7.10-1.el8_6
java-1.8.0-ibm-devel
Red Hat:enterprise_linux:8::supplementary
From an advisory covering 5 CVEs
before 1:1.8.0.7.10-1.el8_6
1:1.8.0.7.10-1.el8_6
java-1.8.0-ibm-headless
Red Hat:enterprise_linux:8::supplementary
From an advisory covering 5 CVEs
before 1:1.8.0.7.10-1.el8_6
1:1.8.0.7.10-1.el8_6
Show 12 moreShow less
Affected packages
PackageAffectedFixed
java-1.8.0-ibm-jdbc
Red Hat:enterprise_linux:8::supplementary
From an advisory covering 5 CVEs
before 1:1.8.0.7.10-1.el8_6
1:1.8.0.7.10-1.el8_6
java-1.8.0-ibm-plugin
Red Hat:enterprise_linux:8::supplementary
From an advisory covering 5 CVEs
before 1:1.8.0.7.10-1.el8_6
1:1.8.0.7.10-1.el8_6
java-1.8.0-ibm-src
Red Hat:enterprise_linux:8::supplementary
From an advisory covering 5 CVEs
before 1:1.8.0.7.10-1.el8_6
1:1.8.0.7.10-1.el8_6
java-1.8.0-ibm-webstart
Red Hat:enterprise_linux:8::supplementary
From an advisory covering 5 CVEs
before 1:1.8.0.7.10-1.el8_6
1:1.8.0.7.10-1.el8_6
java-1_8_0-openj9
openSUSE:Leap 15.3
From an advisory covering 9 CVEs
before 1.8.0.345-150200.3.24.1
1.8.0.345-150200.3.24.1
java-1_8_0-openj9
openSUSE:Leap 15.4
From an advisory covering 9 CVEs
before 1.8.0.345-150200.3.24.1
1.8.0.345-150200.3.24.1
eclipse
Ubuntu:16.04:LTS
All versions, plus listed versions
3.8.1-8
None known
eclipse
Ubuntu:18.04:LTS
All versions, plus listed versions
3.8.1-103.8.1-11
None known
java-11-openj9
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
before 11.0.15.0-1.1
11.0.15.0-1.1
java-1_8_0-openj9
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
before 1.8.0.332-1.1
1.8.0.332-1.1
java-11-openj9
SUSE:Package Hub 15 SP6
From an advisory covering 58 CVEs
before 11.0.26.0-bp156.4.3.1
11.0.26.0-bp156.4.3.1
java-11-openj9
openSUSE:Leap 15.6
From an advisory covering 58 CVEs
before 11.0.26.0-bp156.4.3.1
11.0.26.0-bp156.4.3.1

What each source reports

NVD Score used5.3

In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles.

Record
CVE-2021-41041
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-252, CWE-843, CWE-908
Updated
2026-11-02
CVE ListNo score

In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles.

Record
CVE-2021-41041
Weakness
CWE-252, CWE-843, CWE-908
Updated
2026-11-02
EUVDEUVD-2021-28193No score

In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles.

Record
EUVD-2021-28193
Updated
2026-11-03
GitHub AdvisoriesGHSA-jmjp-ppjm-p7475.3

In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during...

In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles.

Record
GHSA-jmjp-ppjm-p747
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-252
Updated
2026-11-02
OSV5.3

In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles.

Record
CVE-2021-41041
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVRHSA-2022:49595.3

Red Hat Security Advisory: java-1.8.0-ibm security update

Record
RHSA-2022:4959
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 6 moreShow less
OSVRHSA-2022:58375.3

Red Hat Security Advisory: java-1.8.0-ibm security update

Record
RHSA-2022:5837
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2021-410415.3

In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification when verification is triggered by a MethodHandle invocation, allowing unverified methods to be invoked using MethodHandles.

Record
UBUNTU-CVE-2021-41041
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2024:12185-1No score

java-11-openj9-11.0.15.0-1.1 on GA media

These are all security issues fixed in the java-11-openj9-11.0.15.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12185-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12186-1No score

java-1_8_0-openj9-1.8.0.332-1.1 on GA media

These are all security issues fixed in the java-1_8_0-openj9-1.8.0.332-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12186-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:0066-1No score

Security update for java-11-openj9

This update for java-11-openj9 fixes the following issues:

  • Update to OpenJDK 11.0.26 with OpenJ9 0.49.0 virtual machine

  • Including Oracle October 2024 and January 2025 CPU changes

  • Update to OpenJDK 11.0.24 with OpenJ9 0.46.0 virtual machine

  • Including Oracle July 2024 CPU changes

    • CVE-2024-21131 (boo#1228046), CVE-2024-21138 (boo#1228047), CVE-2024-21140 (boo#1228048), CVE-2024-21144 (boo#1228050), CVE-2024-21147 (boo#1228052), CVE-2024-21145 (boo#1228051)
    • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.46/

  • Update to OpenJDK 11.0.23 with OpenJ9 0.44.0 virtual machine

  • Including Oracle April 2024 CPU changes

    • CVE-2024-21012 (boo#1222987), CVE-2024-21094 (boo#1222986), CVE-2024-21011 (boo#1222979), CVE-2024-21085 (boo#1222984), CVE-2024-21068 (boo#1222983)

  • Including OpenJ9/OMR specific fix:

  • Update to OpenJDK 11.0.22 with OpenJ9 0.43.0 virtual machine

  • Including Oracle January 2024 CPU changes

    • CVE-2024-20918 (boo#1218907), CVE-2024-20919 (boo#1218903), CVE-2024-20921 (boo#1218905), CVE-2024-20926 (boo#1218906), CVE-2024-20945 (boo#1218909), CVE-2024-20952 (boo#1218911)
    • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.43/

  • Remove the possibility to put back removes JavaEE modules, since our Java stack does not need this hack any more

  • Update to OpenJDK 11.0.21 with OpenJ9 0.41.0 virtual machine

  • Including Oracle October 2023 CPU changes

    • CVE-2023-22081, boo#1216374

  • Including Openj9 0.41.0 fixes of CVE-2023-5676, boo#1217214

  • Update to OpenJDK 11.0.20.1 with OpenJ9 0.40.0 virtual machine

    • JDK-8313765: Invalid CEN header (invalid zip64 extra data field size)

  • Update to OpenJDK 11.0.20 with OpenJ9 0.40.0 virtual machine

  • Including Oracle April 2023 CPU changes

    • CVE-2023-22006 (boo#1213473), CVE-2023-22036 (boo#1213474), CVE-2023-22041 (boo#1213475), CVE-2023-22045 (boo#1213481), CVE-2023-22049 (boo#1213482), CVE-2023-25193 (boo#1207922)
    • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.40

  • Update to OpenJDK 11.0.19 with OpenJ9 0.38.0 virtual machine

  • Including Oracle April 2023 CPU changes

    • CVE-2023-21930 (boo#1210628), CVE-2023-21937 (boo#1210631), CVE-2023-21938 (boo#1210632), CVE-2023-21939 (boo#1210634), CVE-2023-21954 (boo#1210635), CVE-2023-21967 (boo#1210636), CVE-2023-21968 (boo#1210637)
    • OpenJ9 specific vulnerability: CVE-2023-2597 (boo#1211615)
    • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.38

  • Update to OpenJDK 11.0.18 with OpenJ9 0.36.1 virtual machine

  • Update to OpenJDK 11.0.17 with OpenJ9 0.35.0 virtual machine

    • Including Oracle October 2022 CPU changes CVE-2022-21618 (boo#1204468), CVE-2022-21619 (boo#1204473), CVE-2022-21626 (boo#1204471), CVE-2022-21624 (boo#1204475), CVE-2022-21628 (boo#1204472), CVE-2022-39399 (boo#1204480)
    • Fixes OpenJ9 vulnerability boo#1204703, CVE-2022-3676
    • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.35

  • Update to OpenJDK 11.0.16 with OpenJ9 0.33.0 virtual machine

  • Update to OpenJDK 11.0.15 with OpenJ9…

Record
openSUSE-SU-2025:0066-1
Updated
2026-11-02
OSVSUSE-SU-2022:3092-1No score

Security update for java-1_8_0-openj9

This update for java-1_8_0-openj9 fixes the following issues:

  • Updated to OpenJDK 8u345 build 01 with OpenJ9 0.33.0 virtual machine:

    • CVE-2022-34169: Fixed an integer truncation issue in the Xalan Java XSLT library that occurred when processing malicious stylesheets (bsc#1201684).
    • CVE-2022-21541: Fixed a potential bypass of sandbox restrictions in the Hotspot component (bsc#1201692).
    • CVE-2022-21540: Fixed a potential bypass of sandbox restrictions in the Hotspot component (bsc#1201694).

  • Updated to OpenJDK 8u332 build 09 with OpenJ9 0.32.0 virtual machine:

    • CVE-2021-41041: Failed an issue that could allow unverified methods to be invoked using MethodHandles (bsc#1198935).
    • CVE-2022-21426: Fixed a remote partial denial of service issue (component: JAXP) (bsc#1198672).
    • CVE-2022-21434: Fixed an issue that could allow a remote attacker to update, insert or delete data (component: Libraries) (bsc#1198674).
    • CVE-2022-21443: Fixed a remote partial denial of service issue (component: Libraries) (bsc#1198675).
    • CVE-2022-21476: Fixed an issue that could allow unauthorized access to confidential data (component: Libraries) (bsc#1198671).
    • CVE-2022-21496: Fixed an issue that could allow a remote attacker to update, insert or delete data (component: JNDI) (bsc#1198673).
Record
SUSE-SU-2022:3092-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 174 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open