CVE-2026-91453

A flaw was found in OpenJDK's Lightweight HTTP Server. An unauthenticated remote attacker can exploit this vulnerability over the network by sending crafted requests to exposed server Application Programming Interfaces (APIs). Successful exploitation allows an attacker to perform unauthorized data modifications, potentially inserting, altering, or deleting accessible application data.

This vulnerability is rated as Moderate severity because exploitation requires an application to actively instantiate and expose the embedded OpenJDK lightweight HTTP server to untrusted network traffic, and successful attacks result only in partial integrity compromise without exposing data confidentiality or impacting service availability. OpenJDK packages shipped with Red Hat Enterprise Linux provide this lightweight server API primarily for embedded testing and lightweight standalone utilities rather than general-purpose production web services. Consequently, standard deployments that do not expose custom applications utilizing this specific internal HTTP server interface remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.