CVE-2026-87255

A flaw was found in OpenJDK's Compiler component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted data to exposed compiler Application Programming Interfaces (APIs), such as through a web service. Successful exploitation allows unauthorized read access to accessible data, resulting in information disclosure.

Red Hat has evaluated this vulnerability as having a Low impact because successful exploitation requires high attack complexity, unusual application architecture, and is constrained to limited data exposure. In standard production deployments, Java runtime environments do not expose internal compilation interfaces directly to untrusted network requests. Furthermore, potential exploitation cannot manipulate system state or cause denial of service, confining the blast radius exclusively to unauthorized read access of a restricted subset of process memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.