CVE-2019-2973 is a partial denial-of-service vulnerability affecting Oracle Java SE and Java SE Embedded, specifically within the JAXP component. Affected versions include Java SE 7u231, 8u221, 11.0.4, 13, and Java SE Embedded 8u221. An unauthenticated attacker can exploit this vulnerability over the network, leading to a partial denial of service. The vulnerability has a low CVSS 3.0 base score of 3.7, indicating a low severity. While network-exploitable, the attack complexity is high, and it primarily impacts availability without affecting confidentiality or integrity. This is particularly relevant for Java deployments running untrusted code in sandboxed environments. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.7.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.7.0:update231:*:*:*:*:*:* | ||
1.8.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:1.8.0:update221:*:*:*:*:*:* | ||
11.0.4CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:11.0.4:*:*:*:*:*:*:* | ||
13.0.0CPE matchmatch criteria | cpe:2.3:a:oracle:jdk:13.0.0:*:*:*:*:*:*:* | ||
1.7.0CPE matchmatch criteria | cpe:2.3:a:oracle:jre:1.7.0:update231:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.