CVE-2025-30691

Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 21.0.6, 24; Oracle GraalVM for JDK: 21.0.6 and 24. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

A flaw was found in the OpenJDK just-in-time (JIT) compiler where a change to loop-limit adjustments introduced a possible overflow in the computation of loop limits. This Moderate-impact vulnerability is difficult to exploit: an unauthenticated attacker with network access who is able to supply data to the affected compiler APIs, for example through a web service that feeds data to those APIs, could gain unauthorized read access and unauthorized update, insert, or delete access to a subset of Java SE accessible data. The flaw is primarily a concern for Java deployments, typically in clients, that load and run untrusted code (such as sandboxed Java Web Start applications or sandboxed Java applets) and rely on the Java sandbox for security. Red Hat Product Security rates this flaw as Moderate impact with CVSS 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), consistent with the upstream Oracle severity. The OpenJDK packages in Red Hat Enterprise Linux (java-1.8.0-openjdk, java-17-openjdk, and java-21-openjdk), the Red Hat Build of OpenJDK, and the OpenJDK used by Red Hat Insights are affected; fixes are being pursued for these products and have already been delivered through the errata process for many affected streams. IBM Java 1.8.0 and IBM Semeru Certified JDK 21 builds in Red Hat Enterprise Linux, as well as the OpenJDK builds shipped in Red Hat In-Vehicle OS, are not affected because the vulnerable code is not present in those builds. Older OpenJDK streams that are out of support scope (for example java-1.6.0-openjdk and java-1.7.0-openjdk in RHEL 6 and 7 Extended Life Cycle Support) will not receive fixes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. For supported affected products, updated OpenJDK packages that remediate this flaw have been delivered through Red Hat errata; users are advised to install the latest available updates.