What is the CVSS score and severity of CVE-2026-91403?

CVE-2026-91403 is rated CRITICAL with a CVSS score of 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and is classified under CWE-295 (Improper Certificate / Handshake Validation).

CVE-2026-91403 CRITICAL · CVSS 9.1 · Oracle / OpenJDK — Oracle Java SE & GraalVM (JSSE) · 2026-10-27

CVE-2026-91403: Oracle Java SE / GraalVM JSSE TLS Handshake State Machine

Q: What versions are affected by CVE-2026-91403?

CVE-2026-91403 affects Oracle Java SE / OpenJDK 8u511 (8u431), 11.0.33 (11.0.25), 17.0.21 (17.0.13), 21.0.13 (21.0.5), 25.0.5 (25.0.1), 27.0.1 & GraalVM in Oracle Java SE & GraalVM (JSSE) (Oracle Java SE / GraalVM JSSE TLS Handshake State Machine).

Q: How do I patch or remediate CVE-2026-91403?

To remediate CVE-2026-91403, upgrade to the patched release: Oracle October 2026 Out-of-Band Security Alert Patch / Updated OpenJDK Builds. Apply the Oracle October 2026 Out-of-Band Security Alert update (or equivalent Temurin, Corretto, Azul Zulu, or Red Hat OpenJDK builds) across all JVM workloads. Prioritize internet-facing Spring Boot, Netty, Tomcat, Kafka, and gRPC services that terminate TLS directly inside the JVM via JSSE.

An out-of-band critical vulnerability in the Java Secure Socket Extension (JSSE) TLS 1.3 handshake state machine allows a network attacker to bypass peer validation constraints under specific session resumption and ALPN negotiation paths.

Identifier

CVE-2026-91403

Vendor / Product

Oracle / OpenJDK · Oracle Java SE & GraalVM (JSSE)

Severity / CVSS

CRITICAL · CVSS 9.1

Vector / CWE

CWE-295 (Improper Certificate / Handshake Validation)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected

Oracle Java SE / OpenJDK 8u511 (8u431), 11.0.33 (11.0.25), 17.0.21 (17.0.13), 21.0.13 (21.0.5), 25.0.5 (25.0.1), 27.0.1 & GraalVM

Patched Version

Oracle October 2026 Out-of-Band Security Alert Patch / Updated OpenJDK Builds

Priority

P0 — Apply Oracle Out-of-Band Security Alert Patch

Executive Summary & Technical Impact

Tracked under CVE-2026-91403 (CWE-295 (Improper Certificate / Handshake Validation)), this vulnerability affects Oracle Java SE / OpenJDK 8u511 (8u431), 11.0.33 (11.0.25), 17.0.21 (17.0.13), 21.0.13 (21.0.5), 25.0.5 (25.0.1), 27.0.1 & GraalVM and carries a severity score of 9.1 (CRITICAL). Engineering and security operations teams running Oracle Java SE & GraalVM (JSSE) should prioritize upgrading to Oracle October 2026 Out-of-Band Security Alert Patch / Updated OpenJDK Builds.

Remediation & Patch Guidance

Apply the Oracle October 2026 Out-of-Band Security Alert update (or equivalent Temurin, Corretto, Azul Zulu, or Red Hat OpenJDK builds) across all JVM workloads.
Prioritize internet-facing Spring Boot, Netty, Tomcat, Kafka, and gRPC services that terminate TLS directly inside the JVM via JSSE.

Frequently Asked Questions (CVE-2026-91403)

What versions are affected by CVE-2026-91403?

CVE-2026-91403 affects Oracle Java SE / OpenJDK 8u511 (8u431), 11.0.33 (11.0.25), 17.0.21 (17.0.13), 21.0.13 (21.0.5), 25.0.5 (25.0.1), 27.0.1 & GraalVM in Oracle Java SE & GraalVM (JSSE) (Oracle Java SE / GraalVM JSSE TLS Handshake State Machine).

How do I patch or remediate CVE-2026-91403?

Upgrade affected deployments to Oracle October 2026 Out-of-Band Security Alert Patch / Updated OpenJDK Builds and verify the remediation steps listed above.

What is the CVSS score of CVE-2026-91403?

CVE-2026-91403 is rated CRITICAL with a CVSS score of 9.1 (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Full TechPulse Investigation

Oracle Java SE & GraalVM Out-of-Band Alert: Critical JSSE TLS Flaw (CVE-2026-91403)

Oracle issues an urgent advisory for CVE-2026-91403 (CVSS 9.1) in the Java Secure Socket Extension, remotely exploitable over the network without authentication.

Read full engineering post-mortem (5 min read) →