CVE-2026-70907

A flaw was found in OpenJDK. An unauthenticated remote attacker can cause a Denial of Service (DoS) by repeatedly sending replayed handshake initiation messages (ClientHello) to a Transport Layer Security (TLS) server. Because the server fails to properly restrict the negotiation loop, it emits an unbounded number of retry requests (HelloRetryRequest), consuming server resources.

This flaw is assessed as having a Moderate impact because an unauthenticated remote attacker can cause resource exhaustion, but cannot execute arbitrary code, escalate privileges, or compromise confidential data. In Red Hat environments, exposure is limited to server applications running on OpenJDK that directly accept and terminate TLS 1.3 connections. Deployments fronted by reverse proxies or load balancers that handle TLS termination beforehand, as well as Java client applications, are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.