CVE-2026-91332

A flaw was found in OpenJDK's Networking component. An unauthenticated remote attacker with network access can exploit this vulnerability by sending crafted input to exposed networking Application Programming Interfaces (APIs). Successful exploitation allows the attacker to perform unauthorized data modifications, potentially inserting, altering, or deleting accessible application data.

This vulnerability is rated as Moderate severity because, while it can be exploited remotely without privileges, the impact is confined to low integrity compromise without affecting system confidentiality or availability. The issue resides within OpenJDK's modern HTTP client stack, affecting Java applications that communicate with untrusted servers or through intermediate proxies. Deployments running OpenJDK 8 are not vulnerable because the affected HTTP client codebase is not present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.