CVE-2026-91487
Description
A flaw was found in the OpenJDK Compiler component. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted data to exposed application programming interfaces (APIs), such as through a web service. Successful exploitation could allow the attacker to read, update, or delete a subset of accessible data without authorization.
Statement
This vulnerability is rated with Moderate impact for Red Hat products because triggering the condition requires high attack complexity, specialized target inputs, and grants only partial read or modification privileges without impacting service availability. In typical enterprise environments running Red Hat OpenJDK, the flaw resides in the JIT compiler during bytecode compilation and cannot be leveraged for arbitrary remote code execution. Exploitation requires an attacker to interact with network services that pass tailored parameters through vulnerable methods, limiting the overall blast radius to the context of the running application.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.8 | N/A | 4.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
This can lead to incorrect results and resultant weaknesses. For example, the code might inadvertently compare references to objects, instead of the relevant contents of those objects, causing two "equal" objects to be considered unequal.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
