CVE-2026-34282

OVERVIEW CVE-2026-34282 is a denial-of-service vulnerability in Oracle Java SE's Networking component, affecting multiple versions including Java SE 8, 11, 17, 21, 25, and 26, as well as Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition. The vulnerability can be exploited through APIs in the Networking component, including web services that process untrusted data, and impacts both server deployments and client-side Java applications running through Java Web Start or applets. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no authentication, low complexity, and no user interaction. The attack is easily exploitable and results in high availability impact, allowing attackers to cause either application hangs or repeated crashes leading to complete denial of service. No confidentiality or integrity impacts are associated with this vulnerability. EXPLOITATION STATUS The vulnerability is currently inactive on the Known Exploited Vulnerabilities (KEV) catalog with no evidence of active exploitation in the wild. No public exploit code is currently available, and the extremely low EPSS score of 0.0004 indicates minimal real-world exploitation probability. The moderate FAUCET Risk Score of 47 suggests the vulnerability warrants attention despite low current community activity, particularly given the broad range of affected Java versions and deployment scenarios.