CVE-2026-46917 Oracle Corporation CVE debrief

Who should care

Users of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition should apply security updates to prevent partial denial of service attacks. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for these products. They should review official advisories, assess their exposure, and plan mitigations accordingly.

Technical summary

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). The vulnerability allows an unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks can result in unauthorized ability to cause a partial denial of service (partial DOS). Affected products include Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18.

Defensive priority

Apply security updates for Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition to prevent partial denial of service attacks.

Recommended defensive actions

• Apply security updates for Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition
• Restrict access to APIs in the JSSE component
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability affects Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Supported versions that are affected include Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. The vulnerability allows an unauthenticated attacker with network access via TLS to compromise these products. Successful attacks can result in unauthorized ability to cause a partial denial of service (partial DOS). Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources