CVE-2026-91395

A flaw was found in the Utility component of Java SE and GraalVM. An unauthenticated remote attacker with network access could exploit this vulnerability by submitting crafted data to exposed application programming interfaces (APIs). A successful attack allows unauthorized modification or deletion of accessible data and can result in a partial Denial of Service (DoS).

This vulnerability is evaluated as a Moderate severity flaw for Red Hat products because exploitation requires an application to actively process untrusted archives using the Pack200 unpacking mechanism, and confidentiality is not compromised. Successful exploitation is limited to unauthorized file manipulation or partial service disruption within the operating context and system privileges granted to the Java process. Modern Java releases are not susceptible, as Pack200 support was removed in Java 14 and later, restricting exposure to legacy OpenJDK 8 and 11 runtimes handling untrusted data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.