CVE-2026-91396

A flaw was found in the Utility component of OpenJDK. An unauthenticated remote attacker can exploit this vulnerability by supplying untrusted data to component APIs over the network. A successful attack can allow unauthorized modification or deletion of accessible data and cause a partial Denial of Service (DoS).

Red Hat rates this vulnerability as Moderate because triggering the issue requires a Java application to process untrusted archive data through Pack200 utilities, confining the impact to unauthorized modification of process-accessible files and partial service interruption without exposing confidential system information. In standard enterprise deployments, applications rarely expose archive unpacking routines directly to unauthenticated network clients, mitigating broad exposure. Additionally, the vulnerability is limited to legacy Java environments that retain Pack200 support, as the feature was removed in later OpenJDK releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.