跪拜 Guibai
← Back to the summary

Java's TLS Core Has a CVSS 9.1 Hole: CVE-2026-91403 Hits JDK 8 Through 27

After PHP, Java Has Also Exposed a Critical Security Vulnerability!

Preface

Hello everyone, I am Su San.

In the past few days, the PHP vulnerability has been causing an uproar. Many Java developers were still joking in group chats, saying, “Fortunately we use Java.”

But before they even finished speaking, Java exploded too.

On October 21, 2026, Oracle Java SE was exposed to a CVSS 9.1 high-risk vulnerability, numbered CVE-2026-91403, and the vulnerable component is JSSE (Java Secure Socket Extension).

image.png

What does 9.1 mean?

On a scale of 10, anything above 7 is already high risk, and above 9 means it can be exploited remotely, without authentication, and with low complexity.

And JDK 8, 11, 17, 21, 25, and 27 are all affected.

In this article, I will break down the whole story of this vulnerability, its underlying principles, and what you should do about it.

I hope it helps you.

More real-world projects can be found on the Java Commando website: susan.net.cn/project

1. How Serious Is This Vulnerability?

Let me put the official data out there and let you judge for yourself.

Metric Data
CVE ID CVE-2026-91403
Affected component JSSE (Java Secure Socket Extension)
CVSS 3.1 score 9.1 (CRITICAL)
Attack vector Network (AV:N)
Attack complexity Low (AC:L)
Privileges required None (PR:N)
User interaction None (UI:N)
Impact Complete loss of confidentiality and integrity

Data source: https://www.cve.org/CVERecord?id=CVE-2026-91403

In plain language: the attacker does not need any account, and does not need the victim to click any link. As long as your Java application provides a network service, the attacker can remotely break in, read your data, and tamper with your data.

What is JSSE?

It is the core component in Java responsible for TLS/SSL encrypted communication.

The HTTPS you use, the SSL connections you make to databases, the encrypted channels you use to call external APIs; all of these are handled by JSSE underneath.

In other words, this vulnerability does not affect some business feature; it affects the “secure channel” itself that Java applications use to communicate with the outside world.

2. What Actually Went Wrong Inside JSSE?

Some friends might ask: “After all this talk, how is the attack actually carried out?”

The official disclosure is restrained, only saying that “there is a vulnerability in the JSSE component that can be exploited through web services that supply data to the API.”

But combined with the CVSS vector (AC:L, PR:N, UI:N), several key points can be inferred.

First, the problem lies in input validation or state management.

When JSSE processes TLS handshakes, certificate parsing, or encryption parameter negotiation, it has defects in how certain inputs are handled. An attacker can construct a special network packet to trigger the defect.

Second, no certificate or key is required.

The attacker does not need a valid TLS certificate, nor do they need to know any key, to trigger the vulnerability. That means the bar for attack is extremely low.

Third, the impact covers the entire communication chain.

Once JSSE is broken, the encrypted channel is no longer secure. The attacker may read plaintext data or inject tampered data.

An analogy: your security door (JSSE) is supposed to keep outsiders out, but one part of the door lock has a design flaw. A thief does not need the key; they can pick the lock with a piece of wire. And this lock is installed on almost every Java application.

3. Which Versions Are Affected? Is Your Project Hit?

This is the question everyone cares about most.

Let me list the affected versions released by Oracle:

Product line Affected versions
Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1
Oracle GraalVM for JDK 17.0.21, 21.0.13
Oracle GraalVM Enterprise 21.3.20

Data source

Key point: JDK 8, 11, 17, 21, 25, and 27 are all on the list.

That is, no matter whether you have an old project or a new one, if it is on one of these versions, it is affected.

How to confirm your version?

java -version

If the output contains one of the version numbers listed above, such as java version "1.8.0_511" or openjdk version "21.0.13", you are affected.

Note: these are Oracle's official version numbers.

If you use other OpenJDK distributions (such as Temurin, Corretto, or Zulu), you need to check the security advisory page of the corresponding vendor.

Usually vendors follow up within a few days after Oracle releases a patch.

4. Fix Plan: What Should You Do Now?

4.1 Upgrade the JDK Immediately

Oracle had already released a fixed version on October 20, 2026. You need to upgrade to one of the following versions:

Product line Fixed versions
Oracle Java SE 8u512, 11.0.34, 17.0.22, 21.0.14, 25.0.6, 27.0.2 (or newer)

If you use an OpenJDK distribution, go to the corresponding vendor's download page and find the latest patched version.

Usually within 1 to 3 days after Oracle's release, Temurin, Corretto, and others follow up.

Verification after upgrading:

java -version

Confirm that the version number has become a fixed version.

4.2 If You Cannot Upgrade for Now

Some teams cannot upgrade the JDK in the short term because of compatibility issues.

In this case, temporary mitigations are possible:

Limit the JSSE exposure surface: if your application does not provide TLS services to the outside world (for example, it only runs on the internal network and an Nginx in front handles TLS termination), the exposure surface of this vulnerability is much smaller.

But this does not mean safe; the risk of lateral movement inside the internal network still exists.

Strengthen network-layer monitoring: monitor abnormal TLS handshake traffic on a WAF or IDS.

But this approach treats symptoms, not the root cause; attackers can change their methods.

The most practical advice: upgrade.

For a 9.1-score vulnerability, temporary mitigations are only stopgaps.

5. One Diagram Shows the Impact Chain of This Vulnerability

image.png

6. Why Is Java's Vulnerability More “Fatal” Than PHP's?

The PHP vulnerability affects PHP applications.

The Java vulnerability affects Java's TLS communication layer.

Java's position in the enterprise is too special.

Banks' core transaction systems, e-commerce order services, government data exchange platforms; all of them are built on Java underneath.

What do these systems rely on to communicate with each other?

TLS.

JSSE is the Java implementation of TLS.

If an attacker gets a breakthrough point in JSSE, it is like getting a copy of the “master key” for encrypted communication among all Java applications.

This is also why Oracle gave this vulnerability a 9.1 score, rather than a medium score like previous Spring Boot CVEs (for example, the timing attack in CVE-2026-40972, which required being on the same network segment).

The JSSE vulnerability has a network attack surface and requires no preconditions.

7. By the Way: Spring Boot Is Not Doing Well Either

If you think the Java SE vulnerability is bad enough, the Spring Boot ecosystem's security situation this year is also not optimistic.

In April 2026, Spring Boot 4.0.6 fixed 8 CVEs, including:

There was also CVE-2026-22733 in March, an authentication bypass under the Actuator CloudFoundry endpoint, rated High.

Most Spring Boot vulnerabilities have conditions attached (they require DevTools, specific configuration, or same-network access), but the JSSE vulnerability does not require any preconditions.

That is the difference between 9.1 and 6.x/7.x.

8. Pros and Cons and Applicable Scenarios (for the Fix Options)

Option Pros Cons Applicable scenarios
Upgrade JDK immediately Fixes the root cause, no residual risk Requires compatibility testing All production environments
Temporarily limit exposure Fast, no code changes needed Treats symptoms, not the root cause Emergency transition period
WAF monitoring Provides some early warning Attackers can bypass it Auxiliary measure
Do nothing None Running naked with a 9.1 vulnerability Not recommended

More real-world projects can be found on the Java Commando website: susan.net.cn/project

9. Final Thoughts

Back to the original question: Java has also exposed a critical security vulnerability. What should we do?

The answer is straightforward: upgrade.

A CVSS score of 9.1, remote, no authentication, low complexity.

This is not a vulnerability you can “wait and see”; it is one you should handle today.

JSSE is the secure channel through which Java applications communicate with the outside world. If this channel falls, all subsequent security measures are built on sand.

Concrete steps:

  1. Run java -version to confirm your version.
  2. If the version is on the affected list, download the latest patch from Oracle or your OpenJDK distribution.
  3. Upgrade, run regression tests, and deploy.
  4. If you truly cannot upgrade yet, at least narrow the TLS exposure surface and strengthen monitoring.

Do not think, “My project is on the internal network, so it is fine.”

Lateral movement on the internal network is a real attack path, and the JSSE vulnerability does not require the attacker to first gain a foothold; they can hit your TLS port directly.

The security of the Java ecosystem has never been guaranteed by “Java itself is secure.”

The JDK has vulnerabilities, Spring Boot has vulnerabilities, third-party dependencies have vulnerabilities.

What you can do is keep paying attention, upgrade in time, and do not become the person who is still using an affected version.

Reference resources: