Search for vulnerabilities
Vulnerability details: VCID-u3j4-vg4z-bkeq
Vulnerability ID VCID-u3j4-vg4z-bkeq
Aliases CVE-2024-21085
Summary Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Oracle Java SE: 8u401, 8u401-perf, 11.0.22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
Status Published
Exploitability 0.5
Weighted Severity 3.3
Risk 1.6
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-789 Memory Allocation with Excessive Size Value
System Score Found at
cvssv3 3.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21085.json
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.0008 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
epss 0.00082 https://api.first.org/data/v1/epss?cve=CVE-2024-21085
cvssv3.1 3.7 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 3.7 https://lists.debian.org/debian-lts-announce/2024/04/msg00014.html
ssvc Track https://lists.debian.org/debian-lts-announce/2024/04/msg00014.html
cvssv3.1 3.7 https://security.netapp.com/advisory/ntap-20240426-0004/
ssvc Track https://security.netapp.com/advisory/ntap-20240426-0004/
cvssv3.1 3.7 https://www.oracle.com/security-alerts/cpuapr2024.html
ssvc Track https://www.oracle.com/security-alerts/cpuapr2024.html
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21085.json
https://api.first.org/data/v1/epss?cve=CVE-2024-21085
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21011
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21012
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21068
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21085
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21094
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1069678 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1069678
2275001 https://bugzilla.redhat.com/show_bug.cgi?id=2275001
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:data_infrastructure_insights_acquisition_unit:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:data_infrastructure_insights_acquisition_unit:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:data_infrastructure_insights_storage_workload_security_agent:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:data_infrastructure_insights_storage_workload_security_agent:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm:20.3.13:*:*:*:enterprise:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:graalvm:20.3.13:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm:21.3.9:*:*:*:enterprise:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:graalvm:21.3.9:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:java_se:11.0.22:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:java_se:11.0.22:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u401:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:java_se:8u401:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u401:*:*:*:enterprise_performance:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:java_se:8u401:*:*:*:enterprise_performance:*:*:*
cpe:2.3:a:oracle:jdk:11.0.22:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jdk:11.0.22:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.8.0:update401:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jdk:1.8.0:update401:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:11.0.22:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jre:11.0.22:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.8.0:update401:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:jre:1.8.0:update401:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpuapr2024.html https://www.oracle.com/security-alerts/cpuapr2024.html
CVE-2024-21085 https://nvd.nist.gov/vuln/detail/CVE-2024-21085
msg00014.html https://lists.debian.org/debian-lts-announce/2024/04/msg00014.html
ntap-20240426-0004 https://security.netapp.com/advisory/ntap-20240426-0004/
RHSA-2024:1815 https://access.redhat.com/errata/RHSA-2024:1815
RHSA-2024:1816 https://access.redhat.com/errata/RHSA-2024:1816
RHSA-2024:1817 https://access.redhat.com/errata/RHSA-2024:1817
RHSA-2024:1818 https://access.redhat.com/errata/RHSA-2024:1818
RHSA-2024:1819 https://access.redhat.com/errata/RHSA-2024:1819
RHSA-2024:1820 https://access.redhat.com/errata/RHSA-2024:1820
RHSA-2024:1821 https://access.redhat.com/errata/RHSA-2024:1821
RHSA-2024:1822 https://access.redhat.com/errata/RHSA-2024:1822
USN-6810-1 https://usn.ubuntu.com/6810-1/
USN-6811-1 https://usn.ubuntu.com/6811-1/
USN-7096-1 https://usn.ubuntu.com/7096-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21085.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://lists.debian.org/debian-lts-announce/2024/04/msg00014.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-13T20:35:49Z/ Found at https://lists.debian.org/debian-lts-announce/2024/04/msg00014.html
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://security.netapp.com/advisory/ntap-20240426-0004/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-13T20:35:49Z/ Found at https://security.netapp.com/advisory/ntap-20240426-0004/
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://www.oracle.com/security-alerts/cpuapr2024.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-13T20:35:49Z/ Found at https://www.oracle.com/security-alerts/cpuapr2024.html
Exploit Prediction Scoring System (EPSS)
Percentile 0.24426
EPSS Score 0.0008
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:38:09.122758+00:00 Ubuntu USN Importer Import https://usn.ubuntu.com/6810-1/ 37.0.0