Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/353820?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/353820?format=api", "vulnerability_id": "VCID-zsun-4q6p-8fek", "summary": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).", "aliases": [ { "alias": "CVE-2026-22013" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/1077465?format=api", "purl": "pkg:deb/debian/openjdk-11@11.0.31%2B11-1?distro=sid", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/openjdk-11@11.0.31%252B11-1%3Fdistro=sid" }, { "url": "http://public2.vulnerablecode.io/api/packages/1077466?format=api", "purl": "pkg:deb/debian/openjdk-17@17.0.19%2B10-1?distro=sid", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/openjdk-17@17.0.19%252B10-1%3Fdistro=sid" }, { "url": "http://public2.vulnerablecode.io/api/packages/1077467?format=api", "purl": "pkg:deb/debian/openjdk-21@21.0.11%2B10-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/openjdk-21@21.0.11%252B10-1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/1077470?format=api", "purl": "pkg:deb/debian/openjdk-25@25.0.3%2B9-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/openjdk-25@25.0.3%252B9-1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/1077469?format=api", "purl": "pkg:deb/debian/openjdk-25@25.0.3%2B9-2?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/openjdk-25@25.0.3%252B9-2%3Fdistro=trixie" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/933555?format=api", "purl": "pkg:deb/debian/openjdk-11@11.0.24%2B8-2~deb11u1?distro=sid", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gha-995s-7qdg" }, { "vulnerability": "VCID-57sd-8y93-qqhu" }, { "vulnerability": "VCID-6r1k-8y1c-q7fm" }, { "vulnerability": "VCID-jxgd-j4wr-tyb7" }, { "vulnerability": "VCID-sz6r-65q1-q3bh" }, { "vulnerability": "VCID-xte1-h9nn-4bbk" }, { "vulnerability": "VCID-zsun-4q6p-8fek" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/openjdk-11@11.0.24%252B8-2~deb11u1%3Fdistro=sid" }, { "url": "http://public2.vulnerablecode.io/api/packages/933604?format=api", "purl": "pkg:deb/debian/openjdk-17@17.0.12%2B7-2~deb11u1?distro=sid", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gha-995s-7qdg" }, { "vulnerability": "VCID-57sd-8y93-qqhu" }, { "vulnerability": "VCID-6r1k-8y1c-q7fm" }, { "vulnerability": "VCID-jxgd-j4wr-tyb7" }, { "vulnerability": "VCID-sz6r-65q1-q3bh" }, { "vulnerability": "VCID-xte1-h9nn-4bbk" }, { "vulnerability": "VCID-zsun-4q6p-8fek" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/openjdk-17@17.0.12%252B7-2~deb11u1%3Fdistro=sid" }, { "url": "http://public2.vulnerablecode.io/api/packages/933602?format=api", "purl": "pkg:deb/debian/openjdk-17@17.0.17%2B10-1~deb12u1?distro=sid", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gha-995s-7qdg" }, { "vulnerability": "VCID-57sd-8y93-qqhu" }, { "vulnerability": "VCID-6r1k-8y1c-q7fm" }, { "vulnerability": "VCID-jxgd-j4wr-tyb7" }, { "vulnerability": "VCID-sz6r-65q1-q3bh" }, { "vulnerability": "VCID-xte1-h9nn-4bbk" }, { "vulnerability": "VCID-zsun-4q6p-8fek" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/openjdk-17@17.0.17%252B10-1~deb12u1%3Fdistro=sid" }, { "url": "http://public2.vulnerablecode.io/api/packages/933654?format=api", "purl": "pkg:deb/debian/openjdk-21@21.0.10%2B7-1~deb13u1?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gha-995s-7qdg" }, { "vulnerability": "VCID-57sd-8y93-qqhu" }, { "vulnerability": "VCID-6r1k-8y1c-q7fm" }, { "vulnerability": "VCID-jxgd-j4wr-tyb7" }, { "vulnerability": "VCID-sz6r-65q1-q3bh" }, { "vulnerability": "VCID-xte1-h9nn-4bbk" }, { "vulnerability": "VCID-zsun-4q6p-8fek" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/openjdk-21@21.0.10%252B7-1~deb13u1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/1062512?format=api", "purl": "pkg:deb/debian/openjdk-21@21.0.11~9ea-1?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gha-995s-7qdg" }, { "vulnerability": "VCID-57sd-8y93-qqhu" }, { "vulnerability": "VCID-6r1k-8y1c-q7fm" }, { "vulnerability": "VCID-jxgd-j4wr-tyb7" }, { "vulnerability": "VCID-sz6r-65q1-q3bh" }, { "vulnerability": "VCID-xte1-h9nn-4bbk" }, { "vulnerability": "VCID-zsun-4q6p-8fek" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/openjdk-21@21.0.11~9ea-1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/933668?format=api", "purl": "pkg:deb/debian/openjdk-25@25.0.2%2B10-1~deb13u2?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gha-995s-7qdg" }, { "vulnerability": "VCID-57sd-8y93-qqhu" }, { "vulnerability": "VCID-6r1k-8y1c-q7fm" }, { "vulnerability": "VCID-jxgd-j4wr-tyb7" }, { "vulnerability": "VCID-m54j-wfuk-yua7" }, { "vulnerability": "VCID-sz6r-65q1-q3bh" }, { "vulnerability": "VCID-xte1-h9nn-4bbk" }, { "vulnerability": "VCID-zsun-4q6p-8fek" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/openjdk-25@25.0.2%252B10-1~deb13u2%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/1062513?format=api", "purl": "pkg:deb/debian/openjdk-25@25.0.3~8ea-1?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gha-995s-7qdg" }, { "vulnerability": "VCID-57sd-8y93-qqhu" }, { "vulnerability": "VCID-6r1k-8y1c-q7fm" }, { "vulnerability": "VCID-jxgd-j4wr-tyb7" }, { "vulnerability": "VCID-m54j-wfuk-yua7" }, { "vulnerability": "VCID-sz6r-65q1-q3bh" }, { "vulnerability": "VCID-xte1-h9nn-4bbk" }, { "vulnerability": "VCID-zsun-4q6p-8fek" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/openjdk-25@25.0.3~8ea-1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/1076533?format=api", "purl": "pkg:rpm/redhat/java-11-openjdk@1:11.0.31.0.11-1?arch=el8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gha-995s-7qdg" }, { "vulnerability": "VCID-41qj-62x6-tqe5" }, { "vulnerability": "VCID-57sd-8y93-qqhu" }, { "vulnerability": "VCID-6fzj-746j-bkbc" }, { "vulnerability": "VCID-6r1k-8y1c-q7fm" }, { "vulnerability": "VCID-7qam-er5a-gbas" }, { "vulnerability": "VCID-dm7h-c7wt-1kbs" }, { "vulnerability": "VCID-j7dk-wzkm-tfcr" }, { "vulnerability": "VCID-jxgd-j4wr-tyb7" }, { "vulnerability": "VCID-ptgq-884e-mkft" }, { "vulnerability": "VCID-rm7f-ybuf-dyfq" }, { "vulnerability": "VCID-sz6r-65q1-q3bh" }, { "vulnerability": "VCID-xte1-h9nn-4bbk" }, { "vulnerability": "VCID-xyhj-84d1-dqh3" }, { "vulnerability": "VCID-zsun-4q6p-8fek" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/java-11-openjdk@1:11.0.31.0.11-1%3Farch=el8" }, { "url": "http://public2.vulnerablecode.io/api/packages/1076534?format=api", "purl": "pkg:rpm/redhat/java-11-openjdk@1:11.0.31.0.11-1?arch=el7_9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gha-995s-7qdg" }, { "vulnerability": "VCID-41qj-62x6-tqe5" }, { "vulnerability": "VCID-57sd-8y93-qqhu" }, { "vulnerability": "VCID-6fzj-746j-bkbc" }, { "vulnerability": "VCID-6r1k-8y1c-q7fm" }, { "vulnerability": "VCID-7qam-er5a-gbas" }, { "vulnerability": "VCID-dm7h-c7wt-1kbs" }, { "vulnerability": "VCID-j7dk-wzkm-tfcr" }, { "vulnerability": "VCID-jxgd-j4wr-tyb7" }, { "vulnerability": "VCID-ptgq-884e-mkft" }, { "vulnerability": "VCID-rm7f-ybuf-dyfq" }, { "vulnerability": "VCID-sz6r-65q1-q3bh" }, { "vulnerability": "VCID-xte1-h9nn-4bbk" }, { "vulnerability": "VCID-xyhj-84d1-dqh3" }, { "vulnerability": "VCID-zsun-4q6p-8fek" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/java-11-openjdk@1:11.0.31.0.11-1%3Farch=el7_9" }, { "url": "http://public2.vulnerablecode.io/api/packages/1076535?format=api", "purl": "pkg:rpm/redhat/java-11-openjdk@1:11.0.31.0.11-1?arch=el9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gha-995s-7qdg" }, { "vulnerability": "VCID-41qj-62x6-tqe5" }, { "vulnerability": "VCID-57sd-8y93-qqhu" }, { "vulnerability": "VCID-6fzj-746j-bkbc" }, { "vulnerability": "VCID-6r1k-8y1c-q7fm" }, { "vulnerability": "VCID-7qam-er5a-gbas" }, { "vulnerability": "VCID-dm7h-c7wt-1kbs" }, { "vulnerability": "VCID-j7dk-wzkm-tfcr" }, { "vulnerability": "VCID-jxgd-j4wr-tyb7" }, { "vulnerability": "VCID-ptgq-884e-mkft" }, { "vulnerability": "VCID-rm7f-ybuf-dyfq" }, { "vulnerability": "VCID-sz6r-65q1-q3bh" }, { "vulnerability": "VCID-xte1-h9nn-4bbk" }, { "vulnerability": "VCID-xyhj-84d1-dqh3" }, { "vulnerability": "VCID-zsun-4q6p-8fek" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/java-11-openjdk@1:11.0.31.0.11-1%3Farch=el9" }, { "url": "http://public2.vulnerablecode.io/api/packages/1076532?format=api", "purl": "pkg:rpm/redhat/java-1.8.0-openjdk@1:1.8.0.492.b09-1?arch=el7_9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gha-995s-7qdg" }, { "vulnerability": "VCID-6fzj-746j-bkbc" }, { "vulnerability": "VCID-6r1k-8y1c-q7fm" }, { "vulnerability": "VCID-jxgd-j4wr-tyb7" }, { "vulnerability": "VCID-sz6r-65q1-q3bh" }, { "vulnerability": "VCID-xte1-h9nn-4bbk" }, { "vulnerability": "VCID-zsun-4q6p-8fek" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/java-1.8.0-openjdk@1:1.8.0.492.b09-1%3Farch=el7_9" }, { "url": "http://public2.vulnerablecode.io/api/packages/1076529?format=api", "purl": "pkg:rpm/redhat/java-25-openjdk@1:25.0.3.0.9-1?arch=el10_2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gha-995s-7qdg" }, { "vulnerability": "VCID-41qj-62x6-tqe5" }, { "vulnerability": "VCID-57sd-8y93-qqhu" }, { "vulnerability": "VCID-6fzj-746j-bkbc" }, { "vulnerability": "VCID-6r1k-8y1c-q7fm" }, { "vulnerability": "VCID-dm7h-c7wt-1kbs" }, { "vulnerability": "VCID-jxgd-j4wr-tyb7" }, { "vulnerability": "VCID-m54j-wfuk-yua7" }, { "vulnerability": "VCID-ptgq-884e-mkft" }, { "vulnerability": "VCID-sz6r-65q1-q3bh" }, { "vulnerability": "VCID-xte1-h9nn-4bbk" }, { "vulnerability": "VCID-zsun-4q6p-8fek" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/java-25-openjdk@1:25.0.3.0.9-1%3Farch=el10_2" }, { "url": "http://public2.vulnerablecode.io/api/packages/1076530?format=api", "purl": "pkg:rpm/redhat/java-25-openjdk@1:25.0.3.0.9-1?arch=el9", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-1gha-995s-7qdg" }, { "vulnerability": "VCID-41qj-62x6-tqe5" }, { "vulnerability": "VCID-57sd-8y93-qqhu" }, { "vulnerability": "VCID-6fzj-746j-bkbc" }, { "vulnerability": "VCID-6r1k-8y1c-q7fm" }, { "vulnerability": "VCID-dm7h-c7wt-1kbs" }, { "vulnerability": "VCID-jxgd-j4wr-tyb7" }, { "vulnerability": "VCID-m54j-wfuk-yua7" }, { "vulnerability": "VCID-ptgq-884e-mkft" }, { "vulnerability": "VCID-sz6r-65q1-q3bh" }, { "vulnerability": "VCID-xte1-h9nn-4bbk" }, { "vulnerability": "VCID-zsun-4q6p-8fek" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/java-25-openjdk@1:25.0.3.0.9-1%3Farch=el9" } ], "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22013.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22013.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-22013", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0004", "scoring_system": "epss", "scoring_elements": "0.12118", "published_at": "2026-04-24T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-22013" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22013", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22013" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1134894", "reference_id": "1134894", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1134894" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460040", "reference_id": "2460040", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460040" }, { "reference_url": "https://www.oracle.com/security-alerts/cpuapr2026.html", "reference_id": "cpuapr2026.html", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-22T14:09:34Z/" } ], "url": "https://www.oracle.com/security-alerts/cpuapr2026.html" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:9254", "reference_id": "RHSA-2026:9254", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:9254" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:9255", "reference_id": "RHSA-2026:9255", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:9255" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:9256", "reference_id": "RHSA-2026:9256", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:9256" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:9682", "reference_id": "RHSA-2026:9682", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:9682" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:9684", "reference_id": "RHSA-2026:9684", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:9684" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:9685", "reference_id": "RHSA-2026:9685", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:9685" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:9687", "reference_id": "RHSA-2026:9687", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:9687" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:9688", "reference_id": "RHSA-2026:9688", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:9688" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:9690", "reference_id": "RHSA-2026:9690", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:9690" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:9691", "reference_id": "RHSA-2026:9691", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:9691" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:9693", "reference_id": "RHSA-2026:9693", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:9693" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:9694", "reference_id": "RHSA-2026:9694", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:9694" } ], "weaknesses": [ { "cwe_id": 319, "name": "Cleartext Transmission of Sensitive Information", "description": "The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors." } ], "exploits": [], "severity_range_score": "5.3 - 5.3", "exploitability": "0.5", "weighted_severity": "4.8", "risk_score": 2.4, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-zsun-4q6p-8fek" }