CVE-2026-87291

A flaw was found in the Java SE Networking component. An unauthenticated remote attacker can exploit this vulnerability by submitting specially crafted data to network application programming interfaces (APIs), such as through a web service. Successful exploitation allows unauthorized read access to a subset of accessible data, leading to information disclosure.

This vulnerability is rated as a Moderate impact for Red Hat because, although it can be triggered remotely without privileges over a network connection, the scope of impact is limited to unauthorized read access without permitting modifications to data or disruption of system availability. In Red Hat environments, exposure requires an application to expose the runtime's built-in HTTP server or related networking APIs to untrusted traffic. Earlier platform releases, including OpenJDK versions 8, 11, and 17, are not affected as they do not contain the vulnerable implementation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.