CVE-2025-30752: 
Amazon Corretto JDK vulnerability analysis and mitigation

CVE-2025-30752 is a vulnerability in the Compiler component of Oracle Java SE and Oracle GraalVM for JDK, classified as an uncontrolled resource consumption issue (CWE-400). It affects Oracle Java SE version 24.0.1 and Oracle GraalVM for JDK version 24.0.1. The vulnerability was published on July 15, 2025, as part of Oracle's July 2025 Critical Patch Update. It carries a CVSS v3.1 base score of 3.7 (Low severity) (Oracle CPU Jul 2025, Red Hat Advisory).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption), meaning the Compiler component fails to properly limit resource usage when processing certain inputs, potentially leading to a partial denial of service. The vulnerability is network-accessible via multiple protocols and requires no authentication or user interaction, but is rated High complexity to exploit, meaning specific conditions must be met. Critically, this vulnerability only applies to Java deployments running sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code from the internet; server-side deployments running only trusted code are not affected (Oracle CPU Jul 2025, Red Hat Advisory).

Successful exploitation can result in a partial denial of service (partial DoS) affecting the availability of Oracle Java SE or Oracle GraalVM for JDK environments. There is no impact on confidentiality or integrity. The scope is limited to client-side Java deployments running sandboxed untrusted code, and the availability impact is rated Low, making this a limited-severity vulnerability with no lateral movement or data exposure risk (Oracle CPU Jul 2025).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.039%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity further reduces practical exploitability (Red Hat Advisory).

Oracle has released patches for this vulnerability as part of the July 2025 Critical Patch Update. Users should upgrade Oracle Java SE and Oracle GraalVM for JDK to versions beyond 24.0.1 as provided in the CPU. As a temporary measure, Oracle recommends restricting network access to Java applications and ensuring only trusted code is executed. Organizations should also consider disabling Java Web Start and Java applet support in browsers where not required (Oracle CPU Jul 2025).