CVE-2026-70907: 
Amazon Corretto JDK vulnerability analysis and mitigation

CVE-2026-70907 is a denial-of-service vulnerability in the JSSE (Java Secure Socket Extension) component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Disclosed on August 18, 2026, as part of Oracle's Critical Security Patch Update (CSPU), it affects Oracle Java SE versions 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, and 26.0.2; Oracle GraalVM for JDK versions 17.0.20 and 21.0.12; and Oracle GraalVM Enterprise Edition 21.3.19. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Oracle CSPU Aug 2026, Red Hat Bugzilla).

The vulnerability is classified under CWE-284 (Improper Access Control) and resides in the TLS server handling logic within the JSSE component. Specifically, a client can repeatedly replay a ClientHello message to a TLS 1.3 server, causing the server to emit an unbounded number of HelloRetryRequest records — a form of resource exhaustion. Exploitation requires no authentication and no user interaction; the attacker only needs network access via TLS. The vulnerability is exploitable only through APIs in the JSSE component (e.g., via a web service), and not through Untrusted Java Web Start applications or Untrusted Java applets (Red Hat Bugzilla, Oracle CSPU Aug 2026).

Successful exploitation results in a partial denial of service (DoS) affecting the availability of the targeted Java SE, GraalVM for JDK, or GraalVM Enterprise Edition service. There is no impact on confidentiality or integrity. The attack can disrupt TLS-based services running on affected Java versions, potentially degrading or halting service for legitimate users. The scope is limited to the affected instance and does not facilitate lateral movement or data exfiltration (Oracle CSPU Aug 2026, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability is rated automatable (per NVD SSVC), meaning it can be exploited without manual interaction, but its impact is limited to partial availability disruption. The EPSS score is approximately 0.293%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat Bugzilla, Oracle CSPU Aug 2026).

1. Reconnaissance: Identify internet-facing services running affected Java SE or GraalVM versions (8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; GraalVM for JDK 17.0.20, 21.0.12; GraalVM Enterprise Edition 21.3.19) that expose TLS 1.3 endpoints, using tools such as Shodan, Censys, or nmap with TLS fingerprinting.
2. Initiate TLS 1.3 handshake: Connect to the target TLS 1.3 server and send a crafted ClientHello message designed to trigger a HelloRetryRequest response from the server.
3. Replay ClientHello repeatedly: Continuously replay the ClientHello message without completing the handshake, causing the server to generate and send an unbounded number of HelloRetryRequest records.
4. Induce resource exhaustion: The server's repeated generation of HelloRetryRequest records consumes server-side resources (CPU, memory, or connection state), resulting in degraded performance or a partial denial of service for legitimate clients (Red Hat Bugzilla, Oracle CSPU Aug 2026).

• Network: Unusually high volume of TLS 1.3 ClientHello messages from a single or small set of source IPs targeting a Java-based TLS service; repeated incomplete TLS handshakes without progression to application data exchange.
• Logs: Java application or server logs showing a large number of HelloRetryRequest emissions in a short time window; TLS handshake timeout or error messages correlating with elevated connection attempts.
• Process: Elevated CPU or memory usage by the Java process serving TLS connections without a corresponding increase in legitimate application traffic; JVM thread dumps showing many threads stuck in TLS handshake processing.

Oracle released patches for this vulnerability on August 18–19, 2026, as part of the August 2026 Critical Security Patch Update. Affected users should upgrade to the next available patched release for their Java SE or GraalVM version. Red Hat has issued multiple errata (RHSA-2026:55775, RHSA-2026:55778, RHSA-2026:55779, RHSA-2026:55780, RHSA-2026:57118) addressing this issue across RHEL 8, RHEL 9, and OpenJDK ELS builds. IBM has also released patches for affected IBM SDK Java Technology Edition and Enterprise Content Management System Monitor products. As a temporary workaround, restrict network access to TLS services running affected Java versions, or disable TLS 1.3 services if operationally feasible (Oracle CSPU Aug 2026, Red Hat Bugzilla, IBM Advisory).

Oracle addressed this vulnerability as part of its August 2026 CSPU, which contained 943 new security patches across product families. Red Hat promptly issued multiple security advisories covering various RHEL versions and OpenJDK ELS builds within one day of Oracle's disclosure. IBM also released advisories for its SDK Java Technology Edition and Enterprise Content Management System Monitor products. Coverage was noted in Linux security roundup publications and Java ecosystem blogs such as Foojay.io, which highlighted the August 2026 release as Java's first monthly CSPU (Oracle CSPU Aug 2026, Red Hat Bugzilla).