Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM for JDK: 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM Enterprise Edition: 20.3.16 and 21.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

oracle CPUJan2025: Java

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0426 advisory.

    The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software     Development Kit.

    Security Fix(es):

    * JDK: Enhance array handling (CVE-2025-21502)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0423 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * JDK: Enhance array handling (CVE-2025-21502)

    Important Changes:

    * The Red Hat build of OpenJDK 17 is now the default system-wide version of Java on Red Hat Enterprise     Linux (RHEL) 9, because the full support phase for Red Hat build of OpenJDK 11 has ended (RHEL-63035,     RHEL-63036).

    The 11.0.25 release was the last release of Red Hat build of OpenJDK 11 from Red Hat in the full support     phase of the lifecycle. The full support phase for Red Hat build of OpenJDK 11 ended on 31 October 2024.

    As a consequence, Red Hat build of OpenJDK 17 will be the default system-wide Java version on RHEL 9 after     31 October 2024.

    Please refer to the Release Notes for Red Hat Build of OpenJDK 11.0.25 [1] for more details, including the     Extended Life Cycle Support (ELS) phase for Red Hat build of OpenJDK 11 and for migration instructions.

    See [2] for instructions on configuring Red Hat build of OpenJDK 17 on RHEL and selecting the default Red     Hat build of OpenJDK version to use system wide.

    [1]     https://docs.redhat.com/en/documentation/red_hat_build_of_openjdk/11/html/release_notes_for_red_hat_build_     of_openjdk_11.0.25/endfullsupport

    [2]     https://docs.redhat.com/en/documentation/red_hat_build_of_openjdk/17/html-     single/configuring_red_hat_build_of_openjdk_17_on_rhel/index

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0422 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * JDK: Enhance array handling (CVE-2025-21502)

    Bug Fix(es):

    * The Red Hat OpenJDK packages rely on the copy-jdk-configs package to transfer configuration files to a     new updated JDK. With this update, the JDK has been updated to use the latest version of copy-jdk-configs,     which has been used for some years on later RHEL versions (RHEL-73867, RHEL-73871, RHEL-73872).

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0421 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * JDK: Enhance array handling (CVE-2025-21502)

    Bug Fix(es):

    * The Red Hat OpenJDK packages rely on the copy-jdk-configs package to transfer configuration files to a     new updated JDK. The version of this package in RHEL 8.4 has been outdated for some time and contains bugs     that have been fixed in later RHEL versions. With this update, both copy-jdk-configs and the JDK have been     updated to use the latest version of copy-jdk-configs, which has been used for some years on later RHEL     versions (RHEL-73870).

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0429 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    This is the initial release of OpenJDK 11 with Extended Lifecycle Support for Red Hat Enterprise Linux     versions 7, 8, and 9.

    Security Fix(es):

    * OpenJDK: Enhance array handling (CVE-2025-21502)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Azul Zulu installed on the remote host is 11 prior to 11.77.14 / 17 prior to 17.55.14 / 21 prior to 21.39.14 / 23 prior to 23.32.12. It is, therefore, affected by a vulnerability as referenced in the 2025-01-21 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Amazon Corretto installed on the remote host is 17 prior to 17.0.14.7.1. It is, therefore, affected by a vulnerability as referenced in the corretto-17-2025-Jan-21 advisory.

  - hotspot/compiler (CVE-2025-21502)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
214504	RHEL 8 / 9 : java-21-openjdk security update for RHEL 8.10, 9.4 and 9.5 (Moderate) (RHSA-2025:0426)	Nessus	Red Hat Local Security Checks	medium
214464	RHEL 9 : java-17-openjdk security update for RHEL 9.0 and 9.2 (Moderate) (RHSA-2025:0423)	Nessus	Red Hat Local Security Checks	medium
214463	RHEL 8 / 9 : java-17-openjdk security update for RHEL 8.6, 8.8, 8.10, 9.4 and 9.5 (Moderate) (RHSA-2025:0422)	Nessus	Red Hat Local Security Checks	medium
214462	RHEL 8 : java-17-openjdk security update for RHEL 8.4 (Moderate) (RHSA-2025:0421)	Nessus	Red Hat Local Security Checks	medium
214461	RHEL 7 / 8 / 9 : java-11-openjdk ELS (RHSA-2025:0429)	Nessus	Red Hat Local Security Checks	medium
214447	Azul Zulu Java Vulnerability (2025-01-21)	Nessus	Misc.	medium
214446	Amazon Corretto Java 17.x < 17.0.14.7.1 Vulnerability	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-21502

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

medium

critical