CVE-2024-21094: 
Amazon Corretto JDK vulnerability analysis and mitigation

CVE-2024-21094 affects Oracle Java SE (versions 8u401, 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22), Oracle GraalVM for JDK (versions 17.0.10, 21.0.2, 22), and Oracle GraalVM Enterprise Edition (versions 20.3.13 and 21.3.9). This vulnerability was disclosed in April 2024 as part of Oracle's Critical Patch Update (Oracle CPU).

The vulnerability is related to the Hotspot component and involves a C2 compilation failure with "Exceeded noderegs array" error. It has been assigned a CVSS 3.1 Base Score of 3.7 (Low) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating a network-accessible vulnerability that is difficult to exploit (NVD).

Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition accessible data. The vulnerability can be exploited through APIs in the specified Component, such as through a web service which supplies data to the APIs (Oracle CPU).

Oracle has released patches for affected versions as part of the April 2024 Critical Patch Update. Users are strongly recommended to apply these security patches as soon as possible. For Java deployments, it's particularly important to update systems that run sandboxed Java Web Start applications or sandboxed Java applets (Oracle CPU).