CVE-2026-91417

A flaw was found in the Common Object Request Broker Architecture (CORBA) component of OpenJDK. An unauthenticated remote attacker could exploit this flaw by sending specially crafted data to exposed application programming interfaces (APIs) over the network. A successful attack can result in a partial Denial of Service (DoS), degrading application availability.

This vulnerability is rated Moderate rather than Important because successful exploitation is restricted to a partial denial of service without compromising confidentiality or data integrity. Within Red Hat environments, the issue primarily concerns legacy Java 8 workloads that expose CORBA or RMI-IIOP services to untrusted networks, while modern OpenJDK versions (11 and later) are not vulnerable due to the complete removal of CORBA modules. Because standard enterprise deployments rarely expose CORBA endpoints directly to untrusted callers, the overall risk and attack surface remain limited.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.