CVE-2026-91452

A flaw was found in the Networking component of Oracle Java SE and GraalVM. An unauthenticated remote attacker can exploit this vulnerability by submitting crafted data across the network to exposed application programming interfaces (APIs), such as through a web service. A successful attack can allow an attacker to perform unauthorized modification, insertion, or deletion of accessible data.

This vulnerability is rated as Moderate impact for Red Hat products because, although it can be triggered remotely without authentication or user interaction, successful exploitation is limited to partial data integrity alterations without compromising confidentiality or system availability. Java runtime environments across Red Hat Enterprise Linux and Red Hat OpenJDK distributions are exposed when hosting web applications or network endpoints that parse untrusted requests via built-in HTTP server APIs. Due to inconsistent request processing, an external attacker submitting malformed requests can manipulate accessible data flows, but the flaw does not facilitate arbitrary code execution or broader infrastructure compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.