Listen to this Post
CVE-2026-47021 is a medium-severity vulnerability affecting the 2D component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. The flaw allows an unauthenticated attacker with network access via multiple protocols to cause a partial denial of service (partial DOS). It is easily exploitable and requires no user interaction or privileges. The vulnerability is triggered through APIs in the 2D component, such as those used in web services that supply data to these APIs. Attackers can craft malicious inputs that, when processed by the 2D rendering engine, lead to excessive resource consumption.
The issue also affects sandboxed Java Web Start applications and Java applets that load untrusted code. The CVSS 3.1 base score is 5.3 (Medium), with the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-1333 (Inefficient Regular Expression Complexity). Exploitation can cause temporary unavailability of the Java service, impacting applications that rely on the 2D component for image processing or rendering. Oracle has released patches, and distributions like Debian, ALT Linux, and RHEL have backported fixes.
DailyCVE Form:
Platform: Oracle Java SE/GraalVM
Version: 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1, GraalVM 17.0.19, 21.0.11, Enterprise 21.3.18
Vulnerability: 2D component denial of service
Severity: Medium (CVSS 5.3)
date: July 21, 2026
Prediction: Patch expected August 2026
What Undercode Say:
Analytics from Undercode indicate active scanning for vulnerable Java endpoints. The following commands can be used to check for the vulnerability:
Check Java version java -version Check for vulnerable versions java -version 2>&1 | grep -E "8u491|11.0.31|17.0.19|21.0.11|25.0.3|26.0.1"
To test for the vulnerability, a crafted image or 2D rendering input can be sent to a Java-based web service:
Example: Sending a malicious image to a vulnerable endpoint curl -X POST -H "Content-Type: image/jpeg" --data-binary @malicious.jpg http://target:8080/process
Exploit:
Exploitation involves sending specially crafted 2D rendering data (e.g., malformed images, fonts, or complex vector graphics) to a Java application that processes such data via the 2D APIs. The attacker can cause the Java process to consume excessive CPU or memory, leading to a denial of service. No authentication or user interaction is required, making it a significant risk for publicly exposed services. The attack can be performed remotely over multiple protocols, including HTTP, RMI, or any other protocol that delivers data to the 2D component.
Protection:
- Upgrade to fixed versions: Oracle Java SE 8u492, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; GraalVM for JDK 17.0.20 and 21.0.12; GraalVM Enterprise Edition 21.3.19.
- Apply vendor patches from Oracle, Red Hat, Debian, or ALT Linux.
- Restrict network access to Java services that use the 2D component.
- Implement input validation and rate limiting for APIs that process external data.
- Use a Web Application Firewall (WAF) to filter malicious payloads.
Impact:
Successful exploitation results in a partial denial of service, causing the Java application to become unresponsive or crash. This can disrupt business operations, especially for applications that rely on image processing, document rendering, or graphical user interfaces. The vulnerability is remotely exploitable without authentication, increasing the risk of widespread attacks. For sandboxed environments (e.g., Java applets), untrusted code can trigger the DoS, bypassing security restrictions. The CVSS score of 5.3 indicates a moderate impact, but the ease of exploitation and network accessibility make it a critical concern for exposed systems.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
