CVE-2026-91373

A flaw was found in OpenJDK's Java Secure Socket Extension (JSSE) component. An unauthenticated remote attacker with network access via Transport Layer Security (TLS) can exploit this vulnerability to cause a partial Denial of Service (DoS). This issue can be triggered when an application or web service processes untrusted network data using the affected JSSE APIs.

Red Hat Product Security rates this vulnerability as Moderate because it allows an unauthenticated network-adjacent or remote attacker to cause resource consumption resulting only in partial service degradation, rather than total denial of service or arbitrary code execution. Within Red Hat Enterprise Linux and containerized environments, exposure is restricted to Java workloads actively terminating TLS traffic using JSSE APIs. Confidentiality and data integrity remain unaffected, as the flaw does not facilitate unauthorized access to sensitive information or memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.