CVE-2026-91461

A flaw was found in the Java Secure Socket Extension (JSSE) component. An unauthenticated remote attacker could exploit this vulnerability over Transport Layer Security (TLS) by sending crafted data to affected application programming interfaces (APIs). A successful attack allows the attacker to cause unauthorized modification, insertion, or deletion of accessible data.

This vulnerability is rated as Low severity because successful exploitation requires difficult-to-achieve attack conditions over TLS and produces only limited integrity impact without compromising system confidentiality or service availability. In Red Hat environments, exposure is restricted to Java workloads that expose JSSE endpoints to untrusted network traffic or process malicious handshakes. Standard Red Hat Enterprise Linux deployments do not expose these interfaces by default without explicitly configured network-facing Java services.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.