Improper input validation in Oracle GraalVM Enterprise Edition - CVE-2025-50059

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU112936

Improper input validation in Oracle GraalVM Enterprise Edition - CVE-2025-50059

Published: July 16, 2025


Vulnerability identifier: #VU112936
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-50059
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Networking component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.


Affected software

Oracle GraalVM Enterprise Edition
Red Hat OpenShift Serverless
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 15 SP5
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat CodeReady Linux Builder for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Legacy Module
Basesystem Module
SUSE Package Hub 15
openSUSE Leap
Ubuntu
SecurID Governance and Lifecycle
IBM Observability with Instana
IBM Decision Optimization for Cloud Pak for Data
IBM Sterling Connect:Direct Web Services
IBM Sterling Control Center
IBM Tivoli Netcool Impact
IBM Sterling Transformation Extender
IBM Robotic Process Automation
Splunk AppDynamics Database Agent
IBM Sterling Connect:Direct for UNIX
IBM SPSS Collaboration and Deployment Services
App Connect Enterprise Certified Container
IBM Cloud Pak for Business Automation
Red Hat build of Keycloak
RSA Identity Governance and Lifecycle
watsonx.data
Cognos Dashboards on Cloud Pak for Data
DataStage on Cloud Pak for Data
CICS Transaction Gateway for Multiplatforms
CICS Transaction Gateway Desktop Edition
Total Storage Service Console (TSSC) / TS4500 IMC
Robotic Process Automation for Cloud Pak
Business Automation Insights
IBM Semeru Runtimes
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
java-1_8_0-ibm-plugin
java-1_8_0-ibm-devel
java-1_8_0-ibm-alsa
java-1_8_0-ibm
java-1_8_0-ibm-32bit
java-1_8_0-ibm-demo
java-1_8_0-ibm-src
java-1_8_0-ibm-devel-32bit
java-1_8_0-openj9-debuginfo
java-1_8_0-openj9-accessibility
java-1_8_0-openj9-devel-debuginfo
java-1_8_0-openj9-headless
java-1_8_0-openj9-headless-debuginfo
java-1_8_0-openj9
java-1_8_0-openj9-javadoc
java-1_8_0-openj9-demo-debuginfo
java-1_8_0-openj9-src
java-1_8_0-openj9-debugsource
java-1_8_0-openj9-devel
java-1_8_0-openj9-demo
java-1.8.0-openjdk-headless
java-1.8.0-openjdk-javadoc
java-1.8.0-openjdk-javadoc-zip
java-1.8.0-openjdk
java-1.8.0-openjdk-accessibility
java-1.8.0-openjdk-devel
java-1.8.0-openjdk-src
java-1.8.0-openjdk-demo
java-11-openjdk-debugsource
java-11-openjdk-devel
java-11-openjdk-headless
java-11-openjdk-demo
java-11-openjdk
java-11-openjdk-debuginfo
java-11-openjdk (Red Hat package)
java-11-openjdk-devel-debuginfo
java-11-openjdk-headless-debuginfo
java-11-openjdk-javadoc
java-11-openjdk-jmods
java-11-openjdk-src
openjdk-lts (Ubuntu package)
java-11-openjdk-static-libs
java-11-openjdk-javadoc-zip
java-17-openjdk (Red Hat package)
java-17-openjdk-demo
java-17-openjdk
java-17-openjdk-devel
java-17-openjdk-headless
java-17-openjdk-javadoc
java-17-openjdk-javadoc-zip
java-17-openjdk-jmods
java-17-openjdk-src
java-17-openjdk-static-libs
java-17-openjdk-debuginfo
java-17-openjdk-devel-debuginfo
java-17-openjdk-debugsource
java-17-openjdk-headless-debuginfo
openjdk-17 (Ubuntu package)
openjdk-17-crac (Ubuntu package)
openjdk-17 (debian package)
java-21-ibm-semeru-certified-jdk (Red Hat package)
java-21-openjdk-demo
java-21-openjdk-javadoc
java-21-openjdk-static-libs
java-21-openjdk-src
java-21-openjdk-jmods
java-21-openjdk
java-21-openjdk-javadoc-zip
java-21-openjdk-devel
java-21-openjdk-headless
java-21-openjdk-devel-debuginfo
java-21-openjdk-headless-debuginfo
java-21-openjdk-debugsource
java-21-openjdk-debuginfo
openjdk-21 (Ubuntu package)
openjdk-21-crac (Ubuntu package)
openjdk-24 (Ubuntu package)
IBM DataPower Gateway
IBM Cloud Pak for Multicloud Management
IBM Enterprise Content Management System Monitor
OpenJDK Java (for Middleware)
Oracle GraalVM for JDK
IBM Cognos Controller
Cloud Pak for Data
Oracle Commerce Guided Search

How to mitigate CVE-2025-50059

Install updates from vendor's website.

IBM Observability with Instana - update to 1.0.307
watsonx.data - update to 2.2.2
IBM Decision Optimization for Cloud Pak for Data - update to 5.2.1
Cognos Dashboards on Cloud Pak for Data - update to 5.3
DataStage on Cloud Pak for Data - update to 5.2.2
IBM Sterling Connect:Direct Web Services - addressed in versions 6.2.0.29, 6.3.0.15, 6.4.0.4
IBM Sterling Control Center - addressed in versions 6.3.1.0.6, 6.4.1.0.1
IBM Tivoli Netcool Impact - update to 7.1.0.37
IBM DataPower Gateway - addressed in versions 10.5.0.19, 10.6.0.7, 10.6.5.0
OpenJDK Java (for Middleware) - addressed in versions 11.0.28, 17.0.16, 21.0.8
IBM Cognos Controller - update to 11.1.2
IBM Robotic Process Automation - addressed in versions 23.0.20.4, 30.0.0.2
Robotic Process Automation for Cloud Pak - addressed in versions 23.0.20.4, 30.0.0.2
Business Automation Insights - update to 25.0.0.0.1
Splunk AppDynamics Database Agent - update to 26.1.0
Red Hat OpenShift Serverless - update to 1
java-1_8_0-ibm-plugin - addressed in versions 1.8.0_sr8.50-30.138.1, 1.8.0_sr8.50-150000.3.104.1
java-1_8_0-ibm-devel - addressed in versions 1.8.0_sr8.50-30.138.1, 1.8.0_sr8.50-150000.3.104.1
java-1_8_0-ibm-alsa - addressed in versions 1.8.0_sr8.50-30.138.1, 1.8.0_sr8.50-150000.3.104.1
java-1_8_0-ibm - addressed in versions 1.8.0_sr8.50-30.138.1, 1.8.0_sr8.50-150000.3.104.1
java-1_8_0-ibm-32bit - update to 1.8.0_sr8.50-150000.3.104.1
java-1_8_0-ibm-demo - update to 1.8.0_sr8.50-150000.3.104.1
java-1_8_0-ibm-src - update to 1.8.0_sr8.50-150000.3.104.1
java-1_8_0-ibm-devel-32bit - update to 1.8.0_sr8.50-150000.3.104.1
java-1_8_0-openj9-debuginfo - update to 1.8.0.462-150200.3.57.1
java-1_8_0-openj9-accessibility - update to 1.8.0.462-150200.3.57.1
java-1_8_0-openj9-devel-debuginfo - update to 1.8.0.462-150200.3.57.1
java-1_8_0-openj9-headless - update to 1.8.0.462-150200.3.57.1
java-1_8_0-openj9-headless-debuginfo - update to 1.8.0.462-150200.3.57.1
java-1_8_0-openj9 - update to 1.8.0.462-150200.3.57.1
java-1_8_0-openj9-javadoc - update to 1.8.0.462-150200.3.57.1
java-1_8_0-openj9-demo-debuginfo - update to 1.8.0.462-150200.3.57.1
java-1_8_0-openj9-src - update to 1.8.0.462-150200.3.57.1
java-1_8_0-openj9-debugsource - update to 1.8.0.462-150200.3.57.1
java-1_8_0-openj9-devel - update to 1.8.0.462-150200.3.57.1
java-1_8_0-openj9-demo - update to 1.8.0.462-150200.3.57.1
java-1.8.0-openjdk-headless - update to 1.8.0.472.b08-1
java-1.8.0-openjdk-javadoc - update to 1.8.0.472.b08-1
java-1.8.0-openjdk-javadoc-zip - update to 1.8.0.472.b08-1
java-1.8.0-openjdk - update to 1.8.0.472.b08-1
java-1.8.0-openjdk-accessibility - update to 1.8.0.472.b08-1
java-1.8.0-openjdk-devel - update to 1.8.0.472.b08-1
java-1.8.0-openjdk-src - update to 1.8.0.472.b08-1
java-1.8.0-openjdk-demo - update to 1.8.0.472.b08-1
IBM Cloud Pak for Multicloud Management - update to 2.3 Fix Pack 12
Cloud Pak for Data - update to 5.2.1
IBM Enterprise Content Management System Monitor - update to 5.7.000 FP1
IBM Sterling Connect:Direct for UNIX - addressed in versions 6.3.0.6, 6.4.0.3
IBM Semeru Runtimes - addressed in versions 8.0.462.0, 11.0.28.0, 17.0.16.0, 21.0.8.0
IBM SPSS Collaboration and Deployment Services - update to 8.6.0.0.5
java-11-openjdk-debugsource - addressed in versions 11.0.28.0-3.90.1, 11.0.28.0-150000.3.129.2
java-11-openjdk-devel - addressed in versions 11.0.28.0-3.90.1, 11.0.28.0-150000.3.129.2
java-11-openjdk-headless - addressed in versions 11.0.28.0-3.90.1, 11.0.28.0-150000.3.129.2
java-11-openjdk-demo - addressed in versions 11.0.28.0-3.90.1, 11.0.28.0-150000.3.129.2
java-11-openjdk - addressed in versions 11.0.28.0-3.90.1, 11.0.28.0-150000.3.129.2
java-11-openjdk-debuginfo - addressed in versions 11.0.28.0-3.90.1, 11.0.28.0-150000.3.129.2
java-11-openjdk (Red Hat package) - addressed in versions 11.0.28.0.6-1.el7_9, 11.0.28.0.6-1.el8, 11.0.28.0.6-1.el9
java-11-openjdk-devel-debuginfo - update to 11.0.28.0-150000.3.129.2
java-11-openjdk-headless-debuginfo - update to 11.0.28.0-150000.3.129.2
java-11-openjdk-javadoc - update to 11.0.28.0-150000.3.129.2
java-11-openjdk-jmods - update to 11.0.28.0-150000.3.129.2
java-11-openjdk-src - update to 11.0.28.0-150000.3.129.2
openjdk-lts (Ubuntu package) - addressed in versions 11.0.28+6-1ubuntu1~18.04.1, 11.0.28+6-1ubuntu1~20.04.1, 11.0.28+6-1ubuntu1~22.04.1, 11.0.28+6-1ubuntu1~24.04.1, 11.0.28+6-1ubuntu1~25.04.1
java-11-openjdk-static-libs - update to 11.0.29.0.7-1
java-11-openjdk - update to 11.0.29.0.7-1
java-11-openjdk-demo - update to 11.0.29.0.7-1
java-11-openjdk-devel - update to 11.0.29.0.7-1
java-11-openjdk-headless - update to 11.0.29.0.7-1
java-11-openjdk-javadoc - update to 11.0.29.0.7-1
java-11-openjdk-javadoc-zip - update to 11.0.29.0.7-1
java-11-openjdk-src - update to 11.0.29.0.7-1
java-11-openjdk-jmods - update to 11.0.29.0.7-1
App Connect Enterprise Certified Container - update to 12.0.17
java-17-openjdk (Red Hat package) - addressed in versions 17.0.16.0.8-1.el8_4, 17.0.16.0.8-1.el8_6, 17.0.16.0.8-1.el9_0, 17.0.16.0.8-2.el8, 17.0.16.0.8-2.el9
java-17-openjdk-demo - addressed in versions 17.0.16.0.8-2.0.1, 17.0.17.0.10-1
java-17-openjdk - addressed in versions 17.0.16.0.8-2.0.1, 17.0.17.0.10-1
java-17-openjdk-devel - addressed in versions 17.0.16.0.8-2.0.1, 17.0.17.0.10-1
java-17-openjdk-headless - addressed in versions 17.0.16.0.8-2.0.1, 17.0.17.0.10-1
java-17-openjdk-javadoc - addressed in versions 17.0.16.0.8-2.0.1, 17.0.17.0.10-1
java-17-openjdk-javadoc-zip - addressed in versions 17.0.16.0.8-2.0.1, 17.0.17.0.10-1
java-17-openjdk-jmods - addressed in versions 17.0.16.0.8-2.0.1, 17.0.17.0.10-1
java-17-openjdk-src - addressed in versions 17.0.16.0.8-2.0.1, 17.0.17.0.10-1
java-17-openjdk-static-libs - addressed in versions 17.0.16.0.8-2.0.1, 17.0.17.0.10-1
java-17-openjdk-debuginfo - update to 17.0.16.0-150400.3.57.1
java-17-openjdk-javadoc - update to 17.0.16.0-150400.3.57.1
java-17-openjdk-headless - update to 17.0.16.0-150400.3.57.1
java-17-openjdk-devel-debuginfo - update to 17.0.16.0-150400.3.57.1
java-17-openjdk-demo - update to 17.0.16.0-150400.3.57.1
java-17-openjdk-devel - update to 17.0.16.0-150400.3.57.1
java-17-openjdk - update to 17.0.16.0-150400.3.57.1
java-17-openjdk-debugsource - update to 17.0.16.0-150400.3.57.1
java-17-openjdk-src - update to 17.0.16.0-150400.3.57.1
java-17-openjdk-jmods - update to 17.0.16.0-150400.3.57.1
java-17-openjdk-headless-debuginfo - update to 17.0.16.0-150400.3.57.1
openjdk-17 (Ubuntu package) - addressed in versions 17.0.16+8~us1-0ubuntu1~18.04.1, 17.0.16+8~us1-0ubuntu1~20.04.6, 17.0.16+8~us1-0ubuntu1~22.04.1, 17.0.16+8~us1-0ubuntu1~24.04.1, 17.0.16+8~us1-0ubuntu1~25.04.1
openjdk-17-crac (Ubuntu package) - update to 17.0.16+8-0ubuntu2~25.04
openjdk-17 (debian package) - update to 17.0.16+8-1~deb12u1
java-21-ibm-semeru-certified-jdk (Red Hat package) - update to 21.0.8.0.9-1.el10
java-21-openjdk-demo - update to 21.0.8.0.9-1.0.1
java-21-openjdk-javadoc - update to 21.0.8.0.9-1.0.1
java-21-openjdk-static-libs - update to 21.0.8.0.9-1.0.1
java-21-openjdk-src - update to 21.0.8.0.9-1.0.1
java-21-openjdk-jmods - update to 21.0.8.0.9-1.0.1
java-21-openjdk - update to 21.0.8.0.9-1.0.1
java-21-openjdk-javadoc-zip - update to 21.0.8.0.9-1.0.1
java-21-openjdk-devel - update to 21.0.8.0.9-1.0.1
java-21-openjdk-headless - update to 21.0.8.0.9-1.0.1
java-21-openjdk-javadoc - update to 21.0.8.0-150600.3.15.1
java-21-openjdk-jmods - update to 21.0.8.0-150600.3.15.1
java-21-openjdk-headless - update to 21.0.8.0-150600.3.15.1
java-21-openjdk-devel-debuginfo - update to 21.0.8.0-150600.3.15.1
java-21-openjdk-demo - update to 21.0.8.0-150600.3.15.1
java-21-openjdk - update to 21.0.8.0-150600.3.15.1
java-21-openjdk-src - update to 21.0.8.0-150600.3.15.1
java-21-openjdk-headless-debuginfo - update to 21.0.8.0-150600.3.15.1
java-21-openjdk-devel - update to 21.0.8.0-150600.3.15.1
java-21-openjdk-debugsource - update to 21.0.8.0-150600.3.15.1
java-21-openjdk-debuginfo - update to 21.0.8.0-150600.3.15.1
openjdk-21 (Ubuntu package) - addressed in versions 21.0.8+9~us1-0ubuntu1~20.04.1, 21.0.8+9~us1-0ubuntu1~22.04.1, 21.0.8+9~us1-0ubuntu1~24.04.1, 21.0.8+9~us1-0ubuntu1~25.04.1
openjdk-21-crac (Ubuntu package) - update to 21.0.8+9-0ubuntu2~25.04
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF006, 24.0.1-IF005, 25.0.0-IF001
openjdk-24 (Ubuntu package) - update to 24.0.2+12~us1-0ubuntu1~25.04.1
Red Hat build of Keycloak - addressed in versions 26.0.13, 26.2.6

External References

Related Security Bulletins