CVE-2025-30698: 
Amazon Corretto JDK vulnerability analysis and mitigation

A vulnerability (CVE-2025-30698) was identified in Oracle Java SE (component: 2D), affecting Oracle Java SE versions 8u441, 8u441-perf, 11.0.26, 17.0.14, 21.0.6, 24, Oracle GraalVM for JDK versions 17.0.14, 21.0.6, 24, and Oracle GraalVM Enterprise Edition versions 20.3.17 and 21.3.13. The vulnerability was disclosed on April 15, 2025, and received a CVSS 3.1 Base Score of 5.6 (Oracle CPU).

This is a difficult-to-exploit vulnerability that allows unauthenticated attackers with network access via multiple protocols to compromise the affected systems. The vulnerability has been assigned a CVSS Vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating network attack vector with high attack complexity, no privileges required, and no user interaction needed (NVD).

Successful exploitation of this vulnerability can result in unauthorized update, insert or delete access to some accessible data, unauthorized read access to a subset of accessible data, and unauthorized ability to cause a partial denial of service (partial DOS) of the affected systems (Oracle CPU).

Oracle has released patches as part of its April 2025 Critical Patch Update. Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply the security patches as soon as possible. The patches are provided only for product versions that are covered under the Premier Support or Extended Support phases of the Lifetime Support Policy (Oracle CPU).