CVE-2026-91397

A flaw was found in OpenJDK's Serviceability component. An unauthenticated attacker with local access to the host system can exploit this vulnerability with user interaction, such as by supplying crafted input to Serviceability application programming interfaces (APIs). A successful attack can result in unauthorized modification or deletion of accessible data, as well as cause a partial Denial of Service (DoS).

This vulnerability is rated as having a Low impact because exploitation is constrained to local environments and necessitates both high execution complexity and specific user interaction. In typical server and container deployments running OpenJDK on Red Hat Enterprise Linux, the serviceability diagnostic interface is not directly exposed to untrusted users. Consequently, any potential unauthorized data alteration or localized denial of service carries a limited blast radius under standard operational conditions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.