CVE-2026-91411

A flaw was found in the Java Generic Security Services (JGSS) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted requests to applications or services utilizing JGSS APIs. A successful attack can cause the application to hang or crash repeatedly, resulting in a Denial of Service (DoS), as well as allow unauthorized modification or deletion of accessible data.

Red Hat Product Security rates this vulnerability as Moderate impact because successful exploitation demands high attack complexity and only compromises availability and partial integrity without exposing confidential data. The flaw only presents risk to enterprise environments where network services directly pass untrusted authentication tokens or requests into Generic Security Services APIs. Furthermore, default deployments using OpenJDK 17 and OpenJDK 21 across current Red Hat Enterprise Linux releases do not include the vulnerable code, confining risk primarily to legacy Java runtimes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.