CVE-2026-91487

A flaw was found in the OpenJDK Compiler component. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted data to exposed application programming interfaces (APIs), such as through a web service. Successful exploitation could allow the attacker to read, update, or delete a subset of accessible data without authorization.

This vulnerability is rated with Moderate impact for Red Hat products because triggering the condition requires high attack complexity, specialized target inputs, and grants only partial read or modification privileges without impacting service availability. In typical enterprise environments running Red Hat OpenJDK, the flaw resides in the JIT compiler during bytecode compilation and cannot be leveraged for arbitrary remote code execution. Exploitation requires an attacker to interact with network services that pass tailored parameters through vulnerable methods, limiting the overall blast radius to the context of the running application.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.