CVE-2026-70906: 
Amazon Corretto JDK vulnerability analysis and mitigation

CVE-2026-70906 is a Denial of Service vulnerability in the 2D component of Oracle Java SE, specifically related to font loading. Affected versions are Oracle Java SE 25.0.4 and 26.0.2. The vulnerability was disclosed on August 18, 2026, as part of Oracle's August 2026 Critical Security Patch Update (CSPU), which contained 943 total security patches. It carries a CVSS v3.1 base score of 7.5 (High) (Oracle CSPU Aug 2026, Red Hat Bugzilla). The vulnerability was reported to Oracle by Weber Leon (Oracle CSPU Aug 2026).

The root cause is Uncontrolled Resource Consumption (CWE-400) in the Java 2D component's font loading subsystem. According to the Red Hat Bugzilla entry, a specially crafted font file can trigger an unrecoverable exception during an FFM (Foreign Function & Memory) upcall, causing the JVM to exit abruptly (Red Hat Bugzilla). The vulnerability is exploitable over the network via multiple protocols with no authentication, no privileges, and no user interaction required, making it easily automatable. It can also be triggered through APIs in the 2D component — for example, via a web service that processes font data — and applies to sandboxed Java Web Start applications and applets that load untrusted code (Oracle CSPU Aug 2026). CAPEC patterns associated with this vulnerability include XML Ping of the Death (CAPEC-147) and Regular Expression Exponential Blowup (CAPEC-492).

Successful exploitation results in a complete Denial of Service — an unauthenticated remote attacker can cause the affected Oracle Java SE instance to hang or crash repeatedly, fully disrupting availability of the application or service. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Services relying on Java SE 25.0.4 or 26.0.2 for processing font or 2D graphics data — including web services, Java Web Start applications, and sandboxed applets — are at risk of complete service disruption (Oracle CSPU Aug 2026).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat Bugzilla). The vulnerability is classified as automatable (no user interaction or authentication required), which lowers the barrier for exploitation once a method is developed. The EPSS score is approximately 0.0044 (0.44%), indicating a low but non-zero probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection signatures have been published by Qualys and Nessus (multiple plugin IDs), enabling scanner-based identification of vulnerable systems.

1. Reconnaissance: Identify internet-facing services running Oracle Java SE 25.0.4 or 26.0.2, particularly web services or APIs that process font or 2D graphics data. Tools like Shodan or Censys can help identify exposed Java-based services.
2. Craft malicious font file: Prepare a specially crafted font file designed to trigger an unrecoverable exception during FFM upcall processing within the Java 2D component.
3. Deliver payload: Submit the malicious font file to the target via any supported network protocol (HTTP, HTTPS, etc.) to an endpoint that passes the data to the Java 2D APIs — for example, a web service that renders or processes fonts server-side.
4. Trigger JVM crash: The malformed font file causes an unrecoverable exception during the FFM upcall, forcing the JVM to exit and resulting in a complete denial of service of the affected application (Red Hat Bugzilla, Oracle CSPU Aug 2026).

• Logs: Unexpected JVM crash logs or fatal error files (hs_err_pid*.log) in the Java working directory, particularly referencing 2D or font-related stack traces; application logs showing abrupt JVM exits without graceful shutdown.
• Process: Java process terminating unexpectedly and repeatedly without a clear application-level cause; JVM exit codes indicating unrecoverable errors during FFM upcall processing.
• Network: Unusual or repeated inbound requests delivering font files or 2D graphics data to Java-based web service endpoints, especially from unexpected source IPs or with anomalous payload sizes.

Oracle has released patches as part of the August 2026 CSPU; users should upgrade to a fixed version of Oracle Java SE beyond 25.0.4 and 26.0.2 (Oracle CSPU Aug 2026). For OpenJDK/Temurin users, the fix is available in Temurin Build of OpenJDK 25.0.4.1, addressed via Red Hat Security Advisory RHSA-2026:57118 (Red Hat Bugzilla). IBM has also released a patch for affected Enterprise Content Management System Monitor products (IBM Advisory). As a temporary workaround, restrict network access to Java-based services that process untrusted font or 2D graphics data, and ensure Java Web Start applications and applets only load code from trusted sources.

Oracle's August 2026 CSPU, which included this fix, was noted for its scale — 943 security patches — and was covered by security news outlets including GBHackers and Waratek (GBHackers). The Azul and Amazon Corretto Java distributions also released corresponding out-of-band updates addressing this and related CVEs, with community discussion on Foojay.io noting this as Java's first monthly CSPU cycle (Foojay.io). No significant independent researcher commentary specific to CVE-2026-70906 has been identified beyond standard vulnerability database entries.