CVE-2026-91394

A flaw was found in the OpenJDK Networking component. This vulnerability allows an unauthenticated remote attacker with network access to cause an information disclosure. By supplying crafted input to networking Application Programming Interfaces (APIs), such as through an exposed web service, an attacker could exploit this flaw to gain unauthorized access to critical data.

This vulnerability is rated as having a Moderate severity rather than Important due to the high attack complexity required for successful exploitation. While unauthenticated remote callers could potentially trigger information exposure, exploitation hinges on target applications passing untrusted input directly into internal OpenJDK HTTP client caching routines. Workloads that do not process untrusted network requests through affected caching APIs are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.