Oracle GraalVM Compiler Bypass via HTTP (JDK17 23.0.13.1, JDK21 23.1.12.1)
CVE-2026-83357 Published on September 15, 2026
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM for JDK, Oracle GraalVM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability Analysis
CVE-2026-83357 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is a Directory traversal Vulnerability?
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVE-2026-83357 has been classified to as a Directory traversal vulnerability or weakness.
Products Associated with CVE-2026-83357
stack.watch emails you whenever new vulnerabilities are published in Oracle GraalVM or Oracle. Just hit a watch button to start following.
Affected Versions
Oracle Corporation Oracle GraalVM for JDK, Oracle GraalVM:- Version Oracle GraalVM for JDK 17:23.0.13.1 is affected.
- Version Oracle GraalVM for JDK 21:23.1.12.1 is affected.
- Version Oracle GraalVM:25.0.4.1 is affected.