CVE-2026-91374
Description
A flaw was found in the Serviceability component of OpenJDK. An unauthenticated remote attacker can exploit this issue across the network by supplying crafted data to exposed application programming interfaces (APIs) or by running untrusted code within a sandboxed Java environment. Successful exploitation may lead to unauthorized data access, allowing the attacker to read and modify sensitive application data.
Statement
This vulnerability is evaluated as having a Moderate impact for Red Hat Enterprise Linux and OpenJDK environments because successful exploitation requires high attack complexity, such as untrusted sandboxed execution or network exposure of internal serviceability endpoints. In standard Red Hat deployments, diagnostic and serviceability tools are not active by default, and typical workloads do not expose these interfaces to unauthenticated network actors. Furthermore, the maximum impact is constrained to partial data disclosure and modification, without causing service disruption or providing full system compromise.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.8 | N/A | 4.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
