CVE-2025-30761

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

A moderate severity vulnerability was found in the Nashorn scripting engine of OpenJDK 8 and OpenJDK 11 as shipped by Red Hat. It affects the java-1.8.0-openjdk packages in Red Hat Enterprise Linux 7, 8, and 9, the java-1.8.0-ibm packages in Red Hat Enterprise Linux 8, and the Red Hat Build of OpenJDK 8 and 11 (java-1.8.0-openjdk-portable, java-1.8.0-openjdk-windows, java-11-openjdk-portable, java-11-openjdk-windows, and the java-11-openjdk ELS streams). The Nashorn option-processing code handled arguments that define the nashorn.args and nashorn.args.prepend configuration properties in an unintended order, so the --no-java security option, which is intended to prevent script code from accessing Java classes and APIs, could be bypassed in some cases. The vulnerability is difficult to exploit: an unauthenticated remote attacker able to supply data to the scripting APIs, for example through a web service that supplies data to those APIs, could bypass the scripting restriction and gain the ability to create, delete, or modify data accessible to the Java runtime, an integrity-only impact. Red Hat rates this flaw MODERATE with a CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N), which matches the upstream Oracle severity, so there is no difference in rating. Red Hat offerings based on Java 17 and Java 21 (java-17-openjdk, java-21-openjdk, java-21-ibm-semeru-certified-jdk, and the corresponding Red Hat Build of OpenJDK builds) are not affected because the vulnerable code is not present in those versions. The affected Java 8 and Java 11 components are delegated to their respective Red Hat product streams, where a fix is being pursued; fixes have been delivered for most affected streams, while no fix is planned for certain older java-1.8.0-ibm Red Hat Enterprise Linux 8 EUS streams, which remain exposed to the residual risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.