{"id":"CVE-2026-91395","title":"openjdk: Enhance Pack200 unpacking (Oracle CPU 2026-10) (CVE-2026-91395)","summary":"A flaw was found in the Utility component of Java SE and GraalVM. An unauthenticated remote attacker with network access could exploit this vulnerability by submitting crafted data to exposed application programming interfaces (APIs). A su…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvssSource":"vendor","cwe":"CWE-22","vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","affected":["build_of_openjdk 1.8","build_of_openjdk_11_els","enterprise_linux 6","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9"],"published":"2026-10-20","updated":"2026-10-22","sourceUpdated":"2026-10-22T22:00:31+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91395.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91395.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-91395"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2557385"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-91395"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91395"},{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00253,"epssPercentile":0.16714,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-22T18:46:53.868340Z"},"ingestedAt":"2026-10-20T22:23:33.777Z","slug":"CVE-2026-91395","body":"## Overview\n\nA flaw was found in the Utility component of Java SE and GraalVM. An unauthenticated remote attacker with network access could exploit this vulnerability by submitting crafted data to exposed application programming interfaces (APIs). A successful attack allows unauthorized modification or deletion of accessible data and can result in a partial Denial of Service (DoS).\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat build of OpenJDK 1.8, Red Hat build of OpenJDK 11 ELS, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat build of OpenJDK 1.8, Red Hat build of OpenJDK 11 ELS, … · updated 2026-10-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91395.json)\n\n**openjdk: Enhance Pack200 unpacking (Oracle CPU 2026-10)** — rated Moderate by Red Hat. Released 2026-10-20, updated 2026-10-22.\n\nAffected:\n\n- Red Hat build of OpenJDK 1.8\n- Red Hat build of OpenJDK 11 ELS\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat build of OpenJDK 1.8\n- Red Hat build of OpenJDK 11 ELS\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\nNot affected:\n\n- Red Hat build of OpenJDK 17\n- Red Hat build of OpenJDK 21\n- Red Hat build of OpenJDK 25\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Hardened Images\n\n## Remediation\n\nOut of support scope","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}