LiveActive security incident?Get immediate response
CVE Record

CVE-2021-35586: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Image...

Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

MediumCVSS 5.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a medium-severity Java ImageIO issue that can let an unauthenticated network attacker cause a partial denial of service. The known impact is availability loss, not data theft or code execution, based on the provided CVSS and Oracle description.

Executive priority

Treat as a routine but necessary patching item. It is not evidenced as actively exploited here, but unauthenticated network reachability and service disruption potential justify prioritizing exposed Java image-processing workloads.

Technical view

CVE-2021-35586 affects Oracle Java SE 7u311, 8u301, 11.0.12, 17 and GraalVM Enterprise Edition 20.3.3, 21.2.0. The ImageIO component is exposed through sandboxed Java clients and APIs processing supplied data. CVSS 3.1 is 5.3: network, low complexity, no privileges, no user interaction, availability low.

Likely exposure

Exposure is most likely where affected Java or GraalVM versions process untrusted image or image-like input, including web services feeding data into ImageIO APIs. Legacy sandboxed Java Web Start or applet deployments relying on the Java sandbox are also called out by Oracle.

Exploitation context

The source bundle does not show CISA KEV listing or active exploitation evidence. Oracle describes the issue as easily exploitable over multiple protocols without authentication, but the stated outcome is partial denial of service only.

Researcher notes

The important scoping detail is Oracle's note: exploitation can occur through sandboxed Java clients or through APIs in the affected component, such as a web service supplying data to ImageIO. Do not broaden impact beyond partial denial of service without additional evidence.

Mitigation direction

  • Apply Oracle Java SE or GraalVM updates from the October 2021 Critical Patch Update guidance.
  • Apply relevant downstream OpenJDK security updates from Debian, Fedora, Gentoo, or vendor advisories.
  • Prioritize internet-facing services that process untrusted images through Java ImageIO.
  • Check NetApp advisories if Java-dependent NetApp products are in scope.
  • If no patch path is clear, follow current vendor guidance for supported runtimes.

Validation and detection

  • Inventory Java SE, JDK, JRE, GraalVM, and OpenJDK versions in production.
  • Confirm no affected versions remain: 7u311, 8u301, 11.0.12, 17, 20.3.3, or 21.2.0.
  • Identify applications or services that pass untrusted data into ImageIO APIs.
  • Verify applicable Oracle, Debian, Fedora, Gentoo, and NetApp advisories are closed in patch records.
  • Review monitoring for availability errors around Java image-processing services.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-35586 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
11Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.3CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L3.91.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.3Medium
CVSS 3.1 vector shape for CVE-2021-35586Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Oracle CorporationJava SE JDK and JREJava SE:7u311, Java SE:8u301, Java SE:11.0.12, Java SE:17, Oracle GraalVM Enterprise Edition:20.3.3, Oracle GraalVM Enterprise Edition:21.2.0Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.