CVE-2026-61308: 
Amazon Corretto JDK vulnerability analysis and mitigation

CVE-2026-61308 is an improper access control vulnerability in the Networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. The root cause is that java.net.HttpURLConnection does not strip Proxy-Authorization headers during cross-host HTTP redirects, potentially exposing credentials to unintended hosts. Affected versions include Oracle Java SE 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, and 26.0.2; Oracle GraalVM for JDK 17.0.20 and 21.0.12; and Oracle GraalVM Enterprise Edition 21.3.19. It was disclosed on August 18, 2026, as part of Oracle's August 2026 Critical Security Patch Update (CSPU), and carries a CVSS v3.1 base score of 6.8 (Medium) (Oracle CSPU Aug 2026, Red Hat Bugzilla).

The vulnerability is classified as CWE-284 (Improper Access Control). Specifically, the java.net.HttpURLConnection class fails to strip Proxy-Authorization headers when following HTTP redirects to a different host, meaning proxy credentials can be inadvertently forwarded to the redirect destination (Red Hat Bugzilla). An unauthenticated remote attacker with network access via HTTP can exploit this by inducing a vulnerable Java client to follow a crafted cross-host redirect, causing the client to leak its proxy credentials to an attacker-controlled server. The vulnerability can also be triggered through APIs in the Networking component (e.g., via a web service supplying data to those APIs) or through sandboxed Java Web Start applications and applets loading untrusted code. Attack complexity is rated High, as exploitation requires specific conditions such as a redirect scenario to be in place (Oracle CSPU Aug 2026).

Successful exploitation results in unauthorized disclosure of sensitive data — specifically, Proxy-Authorization credentials — to an attacker-controlled host. The confidentiality impact is rated High, while integrity and availability are unaffected. Because the vulnerability has a changed scope, attacks can significantly impact additional products or systems beyond the directly vulnerable Java runtime, such as downstream services accessible via the compromised proxy credentials (Oracle CSPU Aug 2026, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.318%, indicating a low probability of exploitation in the near term. NVD SSVC assessment classifies the vulnerability as non-automatable with partial technical impact. The vulnerability was reported to Oracle by researcher Kai Aizen (Oracle CSPU Aug 2026).

1. Setup a malicious redirect server: Configure an attacker-controlled HTTP server to issue a 301/302 redirect response pointing to a different host (the attacker's data-collection endpoint) when contacted by a Java HTTP client.
2. Induce the target to make an HTTP request: Craft a scenario where a vulnerable Java application (using java.net.HttpURLConnection) or a sandboxed Java Web Start/applet makes an HTTP request to the attacker's initial server — for example, via a malicious link, a web service call, or a crafted API response.
3. Capture forwarded Proxy-Authorization header: When the Java client follows the cross-host redirect, it fails to strip the Proxy-Authorization header, forwarding the proxy credentials to the attacker's redirect destination server, where they can be logged and captured.
4. Leverage captured credentials: Use the harvested proxy credentials to authenticate to the victim's proxy server, potentially enabling further network access, traffic interception, or lateral movement within the victim's environment (Oracle CSPU Aug 2026, Red Hat Bugzilla).

• Network: Outbound HTTP requests from Java application servers to unexpected external hosts, particularly following HTTP 301/302 redirects; Proxy-Authorization headers observed in HTTP traffic destined for non-proxy hosts.
• Logs: Java application logs showing HTTP redirect chains to unfamiliar or external domains; proxy server logs indicating authentication attempts from unexpected source IPs using valid credentials shortly after a Java client redirect event.
• Process: Java processes (e.g., java, javaw) initiating HTTP connections to external hosts not in the expected application communication baseline.

Oracle has released patches as part of the August 2026 Critical Security Patch Update (CSPU); users should upgrade to the next available patched release beyond the affected versions (Java SE 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; GraalVM for JDK 17.0.20, 21.0.12; GraalVM Enterprise Edition 21.3.19) (Oracle CSPU Aug 2026). Red Hat has issued multiple errata (RHSA-2026:55775, RHSA-2026:55778, RHSA-2026:55779, RHSA-2026:55780, RHSA-2026:57118) addressing this issue across RHEL 8, RHEL 9, and OpenJDK ELS builds (Red Hat Bugzilla). IBM has also released patches for affected IBM SDK Java Technology Edition and Enterprise Content Management System Monitor products (IBM Advisory). As interim mitigations, restrict network access to systems running affected Java versions, implement network segmentation to isolate Java applications from untrusted sources, and avoid deploying Java Web Start applications or applets from untrusted origins.

Oracle's August 2026 CSPU was noted in security media as one of Oracle's largest monthly patch releases, containing 943 security fixes (GBHackers). Waratek also highlighted the scale of the update (Waratek). The foojay.io community noted that this was Java's first monthly CSPU cycle under Azul's August 2026 release (foojay.io). No specific researcher commentary or social media discussion focused exclusively on CVE-2026-61308 has been identified.