Backend

Java's TLS Core Has a CVSS 9.1 Hole: CVE-2026-91403 Hits JDK 8 Through 27

By 苏三说技术 · Oct 25, 2026

Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Any Java service that terminates TLS on an affected JDK is remotely exploitable without credentials, so internal banking, e-commerce, and data-exchange systems are directly exposed as soon as their network is reachable. A CVSS 9.1 in the TLS stack outranks the conditional Spring Boot CVEs because no precondition has to be met; upgrading is the only move that removes the exposure.

Summary

CVE-2026-91403 sits in JSSE, Java's TLS/SSL implementation, and carries a CVSS 3.1 score of 9.1. The attack vector is network-based, complexity is low, and no privileges or user interaction are required; any Java service that accepts network traffic on an affected build can be hit remotely. Oracle lists JDK 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1 as affected, along with matching GraalVM for JDK and GraalVM Enterprise builds.

Oracle's October 20, 2026 patch set includes 8u512, 11.0.34, 17.0.22, 21.0.14, 25.0.6, and 27.0.2. Until a team upgrades, narrowing the TLS exposure and monitoring for abnormal handshakes lowers risk but does not close the hole. OpenJDK distributions such as Temurin and Corretto usually follow within a few days of Oracle's update.

JSSE works underneath HTTPS, database SSL connections, and encrypted API calls, so the weakness sits in the secure channel itself rather than in one business feature. Recent Spring Boot CVEs mostly require DevTools, special configuration, or same-network access; this JSSE vulnerability has no such precondition, which is why it is rated 9.1 instead of 6.x or 7.x.

Takeaways

— CVE-2026-91403 is rated CVSS 3.1 9.1 Critical and affects Oracle Java SE's JSSE component.

— The CVSS vector is AV:N/AC:L/PR:N/UI:N, meaning network reachable, low complexity, no privileges, and no user interaction.

— Affected builds include JDK 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1, plus Oracle GraalVM for JDK 17.0.21 and 21.0.13 and GraalVM Enterprise 21.3.20.

— Oracle's fixed builds are 8u512, 11.0.34, 17.0.22, 21.0.14, 25.0.6, and 27.0.2, released October 20, 2026.

— Crafted network packets can trigger the flaw during TLS handshake, certificate parsing, or encryption parameter negotiation; no valid TLS certificate or key is needed.

— A java -version check tells a team whether it runs an affected build; OpenJDK vendors like Temurin and Corretto typically follow Oracle with patches within 1 to 3 days.

— If an upgrade is impossible, limiting the TLS exposure surface and watching WAF/IDS logs for abnormal handshakes are temporary measures, not cures.

— Spring Boot 4.0.6 fixed 8 CVEs in April 2026, but those bugs carry preconditions; JSSE does not.

Conclusions

JSSE sits beneath HTTPS, database SSL connections, and encrypted API calls, so a flaw in it exposes the secure channel itself rather than one business function; application logic can be safe while the transport is compromised.

Oracle's 9.1 rating, compared with the 6.x/7.x scores on recent Spring Boot CVEs, tracks the absence of preconditions: Spring Boot bugs need DevTools, specific configuration, or same-network access, while JSSE accepts attacker-controlled packets on the network directly.

The listed mitigations before an upgrade are stopgaps: limiting exposure only shrinks the reachable TLS ports, and WAF/IDS monitoring only raises the chance of noticing an attack. Neither removes the underlying flaw, so the recommended fix is to upgrade today.

Concepts & terms

JSSE

Java Secure Socket Extension, Java's built-in TLS/SSL implementation. It handles HTTPS, SSL database connections, and encrypted API calls inside the JDK.

CVSS 3.1

Common Vulnerability Scoring System version 3.1, a 0-to-10 severity scale. A vector of AV:N/AC:L/PR:N/UI:N means the flaw is reachable over the network, requires low attack complexity, needs no privileges, and needs no user interaction.

TLS termination

Decrypting incoming TLS traffic at an edge proxy or load balancer such as Nginx, so backend services receive plaintext traffic and do not process TLS handshakes. It reduces JSSE exposure but does not patch the vulnerability.

Source: juejin.cn ↗ Google Translate ↗ Backup ↗