CVE-2025-21502

Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to Oracle Java SE accessible. This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security.

MODERATE impact affects some Red Hat Enterprise Linux products using OpenJDK and IBM Java. An unauthenticated attacker with network access via multiple protocols may exploit APIs supplied through a web service to cause unauthorized update, insertion, or deletion of accessible Java SE data. The underlying issue is a C2 compiler optimization that incorrectly assumes an unsigned comparison is always true, including when m == -1. The current scope is product- and stream-specific: entries for java-11-openjdk and java-1.8.0-ibm are marked AFFECTED, while multiple java-1.8.0-openjdk entries are marked NOTAFFECTED; other entries are NEW or DELEGATED. The upstream and Red Hat CVSS scores are both 4.8 (MODERATE).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.