Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
CVE-2026-87255: Oracle Java SE may let remote users read data
CVE-2026-87255 · published 13 days ago
Summary
Certain versions of Oracle Java SE and related OpenJDK builds can be persuaded by network traffic to reveal some of the program's stored information without requiring a login. This could allow an outsider who can reach the server to see data that should be private. Apply the latest security updates for Java and OpenJDK or disable the affected compiler component until a patch is available.
What to do
- Update debian openjdk-25 to version 25.0.5+8-1.
- Update bellsoft openjdk25 to version 25.0.5.0.3_p5-r0.
- Update bellsoft openjdk25-container-jre to version 25.0.5.0.3_p5-r0.
- Update bellsoft openjdk25-lite to version 25.0.5.0.3_p5-r0.
- Update bellsoft openjdk27 to version 27.0.1.0.3_p5-r0.
- Update bellsoft openjdk27-container-jre to version 27.0.1.0.3_p5-r0.
- Update bellsoft openjdk27-lite to version 27.0.1.0.3_p5-r0.
- Update openjdk25-container-jre to version 25.0.5.0.3_p5-r0.
- Update openjdk25-lite to version 25.0.5.0.3_p5-r0.
- Update openjdk27-container-jre to version 27.0.1.0.3_p5-r0.
- Update openjdk27-lite to version 27.0.1.0.3_p5-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | oracle corporation | oracle java se | 25.0.4.1 |
| Debian:13 | debian | openjdk-25 | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | openjdk-8 | All versions |
| Ubuntu:16.04:LTS | canonical | openjdk-9 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | openjdk-lts | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | openjdk-17 | All versions |
| Ubuntu:20.04:LTS | canonical | openjdk-13 | All versions |
| Ubuntu:20.04:LTS | canonical | openjdk-16 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | openjdk-21 | All versions |
| Ubuntu:22.04:LTS | canonical | openjdk-18 | All versions |
| Ubuntu:22.04:LTS | canonical | openjdk-25 | All versions |
| Ubuntu:26.10 | canonical | openjdk-17-crac | All versions |
| Ubuntu:26.10 | canonical | openjdk-21-crac | All versions |
| Ubuntu:26.10 | canonical | openjdk-27 | All versions |
| Debian:14 | debian | openjdk-27 | All versions |
| Debian:14 | debian | openjdk-25 |
< 25.0.5+8-1 Fix: upgrade to 25.0.5+8-1
|
| Alpaquita:23 | bellsoft | openjdk25 |
>= 25_p37-r0, < 25.0.5.0.3_p5-r0 Fix: upgrade to 25.0.5.0.3_p5-r0
|
| Alpaquita:23 | bellsoft | openjdk25-container-jre |
>= 25_p37-r0, < 25.0.5.0.3_p5-r0 Fix: upgrade to 25.0.5.0.3_p5-r0
|
| Alpaquita:23 | bellsoft | openjdk25-lite |
>= 25_p37-r0, < 25.0.5.0.3_p5-r0 Fix: upgrade to 25.0.5.0.3_p5-r0
|
| Alpaquita:23 | bellsoft | openjdk27 |
>= 27_p36-r0, < 27.0.1.0.3_p5-r0 Fix: upgrade to 27.0.1.0.3_p5-r0
|
| Alpaquita:23 | bellsoft | openjdk27-container-jre |
>= 27_p36-r0, < 27.0.1.0.3_p5-r0 Fix: upgrade to 27.0.1.0.3_p5-r0
|
| Alpaquita:23 | bellsoft | openjdk27-lite |
>= 27_p36-r0, < 27.0.1.0.3_p5-r0 Fix: upgrade to 27.0.1.0.3_p5-r0
|
| BellSoft Hardened Containers:23 | – | openjdk25-container-jre |
>= 25_p37-r0, < 25.0.5.0.3_p5-r0 Fix: upgrade to 25.0.5.0.3_p5-r0
|
| BellSoft Hardened Containers:23 | – | openjdk25-lite |
>= 25_p37-r0, < 25.0.5.0.3_p5-r0 Fix: upgrade to 25.0.5.0.3_p5-r0
|
| BellSoft Hardened Containers:23 | – | openjdk27-container-jre |
>= 27_p36-r0, < 27.0.1.0.3_p5-r0 Fix: upgrade to 27.0.1.0.3_p5-r0
|
| BellSoft Hardened Containers:23 | – | openjdk27-lite |
>= 27_p36-r0, < 27.0.1.0.3_p5-r0 Fix: upgrade to 27.0.1.0.3_p5-r0
|
Original advisory text
BELL-CVE-2026-87255
Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
References
- https://www.oracle.com/security-alerts/cpuoct2026.html vendor-advisory
- https://ubuntu.com/security/CVE-2026-87255 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-87255 Third Party Advisory
- https://openjdk.org/groups/vulnerability/advisories/2026-10-20 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-87255 Vendor Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-87255 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-287Improper Authentication
Timeline
Published22 Oct 2026
Updated4 Nov 2026
First seen20 Oct 2026
Sources
CVE-2026-87255 · NVD
CVE-2026-87255 · MITRE
DEBIAN-CVE-2026-87255 · OSV
UBUNTU-CVE-2026-87255 · OSV
BELL-CVE-2026-87255 · OSV
Track software like this
Free during beta