CVE-2026-34282: 
Amazon Corretto JDK vulnerability analysis and mitigation

CVE-2026-34282 is a Denial-of-Service vulnerability in the Networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, disclosed as part of Oracle's April 2026 Critical Patch Update. The flaw affects Oracle Java SE versions 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, and 26; Oracle GraalVM for JDK versions 17.0.18 and 21.0.10; and Oracle GraalVM Enterprise Edition version 21.3.17. It carries a CVSS v3.1 base score of 7.5 (High), reflecting its network-accessible, unauthenticated, low-complexity attack profile with complete availability impact (Oracle CPU Apr 2026, Github Advisory).

The root cause is an infinite loop (CWE-835) or uncontrolled resource consumption (CWE-400) in Java's TLS connection handling within the Networking component. Specifically, when a TLS server sends a close_notify alert to terminate the connection but then writes additional data over the same TCP connection before closing, the affected Java thread becomes stuck at 100% CPU utilization (Red Hat Bugzilla). The vulnerability is exploitable remotely without authentication via multiple network protocols, either through direct API usage or indirectly via web services that supply data to the affected Networking APIs. It also applies to sandboxed Java Web Start applications and Java applets that load untrusted code from the internet (Oracle CPU Apr 2026). Upstream OpenJDK fix commits are publicly available for JDK 11, 17, 21, and 25 branches (Red Hat Bugzilla).

Successful exploitation results in a complete Denial-of-Service condition — the affected Java process hangs indefinitely or crashes repeatedly, with no impact on confidentiality or integrity. Any Java application or service relying on TLS connections could be rendered unavailable, including web services, application servers, and client-side Java deployments. Given the breadth of affected versions spanning Java 8 through 26 and multiple GraalVM editions, the potential scope of disruption is significant across enterprise environments running IBM Semeru Runtime, IBM App Connect Enterprise, IBM Sterling Transformation Extender, and other Java-based products (Oracle CPU Apr 2026, Github Advisory).

1. Reconnaissance: Identify internet-facing Java-based services (web servers, APIs, application servers) running affected versions of Oracle Java SE (8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26) or GraalVM using tools like Shodan, Censys, or banner grabbing.
2. Establish TLS connection: Initiate a TLS connection to the target Java service using any supported protocol (HTTPS, LDAPS, etc.).
3. Trigger malformed TLS termination: Craft a TLS server response that sends a close_notify alert to signal connection termination, but then immediately writes additional data over the same TCP connection before fully closing it — mimicking a misbehaving TLS peer.
4. Induce infinite loop: The vulnerable Java Networking code enters an unreachable exit condition (infinite loop) while processing the unexpected post-close_notify data, causing the handling thread to spin at 100% CPU.
5. Achieve DoS: Repeat the connection pattern to exhaust available CPU threads, causing the Java application to hang or crash repeatedly, resulting in a complete service outage (Red Hat Bugzilla, Oracle CPU Apr 2026).

• Process: Java process threads pegged at 100% CPU utilization with no corresponding legitimate workload; thread dumps showing threads stuck in TLS/SSL socket read or close operations within the java.net or javax.net.ssl packages.
• Logs: Application logs showing repeated TLS handshake or connection close errors; Java garbage collection logs indicating thread starvation or heap pressure caused by stuck threads.
• Network: Unusual inbound TLS connections that send a close_notify alert followed immediately by additional data before TCP close; connections from unexpected source IPs targeting TLS-enabled Java service ports.
• System: Elevated CPU usage on Java application servers without corresponding increase in legitimate request volume; watchdog or health-check alerts indicating service unresponsiveness or timeout.

Oracle has released fixed versions as part of the April 2026 Critical Patch Update: Oracle Java SE 11.0.31, 17.0.19, 21.0.11, and 25.0.3 contain the fix (Red Hat Bugzilla). Upstream OpenJDK patches are available for JDK 11, 17, 21, and 25 branches. Downstream vendors including Red Hat (RHSA-2026:9254, RHSA-2026:9255, RHSA-2026:9690, RHSA-2026:9693, RHSA-2026:9694, RHSA-2026:11403, RHSA-2026:11822, RHSA-2026:22328), IBM (Semeru Runtime, App Connect Enterprise, Sterling Transformation Extender, Content Manager Enterprise Edition, License Metric Tool), SUSE, Debian, Ubuntu, Amazon Linux, and others have released updated packages (Oracle CPU Apr 2026). As a temporary workaround where patching is not immediately possible, implement network-level controls to restrict access to Java TLS services from untrusted sources, and monitor for abnormal CPU spikes on Java processes.

The vulnerability received standard coverage across Linux distribution security channels, with Red Hat, SUSE, Debian, Ubuntu, Amazon Linux, and AlmaLinux all issuing advisories and updated packages within days to weeks of Oracle's disclosure. IBM published multiple security bulletins addressing the impact on Semeru Runtime and downstream products including App Connect Enterprise, Sterling Transformation Extender, Content Manager Enterprise Edition, and License Metric Tool. Azul Systems noted the update in a blog post encouraging Java runtime operators to apply security updates promptly (Azul Blog). No significant independent researcher commentary or social media discussion beyond routine vulnerability tracking was observed.