CVE-2026-87367
Description
A flaw was found in the JAXP (Java API for XML Processing) component of OpenJDK. An unauthenticated remote attacker can exploit this vulnerability by providing crafted input to applications or web services that process data through JAXP APIs. Successful exploitation allows the attacker to perform unauthorized data modifications, including updating, inserting, or deleting accessible data.
Statement
This vulnerability is rated as Low severity because successful exploitation requires high complexity and specially constructed input to JAXP template processing APIs, resulting in limited integrity impact without compromising confidentiality or service availability. In Red Hat Enterprise Linux and containerized OpenJDK environments, exposure is restricted to applications that accept untrusted XML or template data without adequate validation. General Java workloads that do not parse external template content remain unaffected.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | N/A | 3.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
