CVE-2026-91453
Description
A flaw was found in OpenJDK's Lightweight HTTP Server. An unauthenticated remote attacker can exploit this vulnerability over the network by sending crafted requests to exposed server Application Programming Interfaces (APIs). Successful exploitation allows an attacker to perform unauthorized data modifications, potentially inserting, altering, or deleting accessible application data.
Statement
This vulnerability is rated as Moderate severity because exploitation requires an application to actively instantiate and expose the embedded OpenJDK lightweight HTTP server to untrusted network traffic, and successful attacks result only in partial integrity compromise without exposing data confidentiality or impacting service availability. OpenJDK packages shipped with Red Hat Enterprise Linux provide this lightweight server API primarily for embedded testing and lightweight standalone utilities rather than general-purpose production web services. Consequently, standard deployments that do not expose custom applications utilizing this specific internal HTTP server interface remain unaffected.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 5.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
