CVE-2026-22018

CVE-2026-22018 is a denial-of-service vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition that affects multiple supported versions including Java SE 8, 11, 17, 21, 25, and 26. The vulnerability exists in the Libraries component and can be exploited remotely over network protocols without authentication or user interaction. The vulnerability presents a low severity risk with a CVSS score of 3.7, requiring high attack complexity to exploit. While the attack vector is network-accessible and requires no user interaction, the impact is limited to partial denial-of-service conditions affecting availability only, with no impact on confidentiality or integrity. The vulnerability can be exploited through APIs in the Libraries component, including web services that supply data to those APIs. There is no evidence of active exploitation in the wild. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and remains inactive on threat tracking lists. The EPSS score of 0.00039 indicates extremely low probability of exploitation, suggesting minimal community attention and no publicly available exploit code at this time.