PT-2025-42977 · Oracle · Graalvm For Jdk 21.0.8+1

Published 2025-10-14 · Updated 2025-10-27 · CVE-2025-61755

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle GraalVM for JDK versions 17.0.16 and 21.0.8

Description A difficult to exploit issue exists in the Oracle GraalVM for JDK product of Oracle Java SE, specifically within the Compiler component. An unauthenticated attacker with network access, utilizing multiple protocols, may be able to compromise the system and gain unauthorized read access to a subset of Oracle GraalVM for JDK data.

Recommendations Update Oracle GraalVM for JDK version 17.0.16 to a newer, fixed version. Update Oracle GraalVM for JDK version 21.0.8 to a newer, fixed version.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-14034

CVE-2025-61755

Affected Products

Graalvm For Jdk 17.0.16

Graalvm For Jdk 21.0.8

References · 7

• https://osv.dev/vulnerability/CVE-2025-61755 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2025.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14034 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61755 · Security Note
• https://twitter.com/VulmonFeeds/status/1980816224960364629 · Twitter Post
• https://t.me/cveNotify/140553 · Telegram Post
• https://twitter.com/CVEnew/status/1980736596879237435 · Twitter Post