CVE-2008-5351 — OpenJDK UTF-8 decoder accepts non-shortest form sequences (4486841)

Back Back to CVE browser

HIGH

OpenJDK UTF-8 decoder accepts non-shortest form sequences (4486841)

Published Dec 5, 2008

7.5

HIGH

CVSS 2.0

EPSS 3.43%

Description

Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier accepts UTF-8 encodings that are not the "shortest" form, which makes it easier for attackers to bypass protection mechanisms for other applications that rely on shortest-form UTF-8 encodings.

Affected products

Sun / Jdk Application

≤ 5.0
Sun / Jdk Application

≤ 6
Sun / Jdk Application

5.0
Sun / Jdk Application

5.0
Sun / Jdk Application

5.0
Sun / Jdk Application

5.0
Sun / Jdk Application

5.0
Sun / Jdk Application

5.0
Sun / Jdk Application

5.0
Sun / Jdk Application

5.0
Sun / Jdk Application

5.0
Sun / Jdk Application

5.0
Sun / Jdk Application

5.0
Sun / Jdk Application

5.0
Sun / Jdk Application

5.0
Sun / Jdk Application

5.0
Sun / Jdk Application

5.0
Sun / Jdk Application

6
Sun / Jdk Application

6
Sun / Jdk Application

6
Sun / Jdk Application

6
Sun / Jdk Application

6
Sun / Jdk Application

6
Sun / Jdk Application

6
Sun / Jdk Application

6
Sun / Jdk Application

6
Sun / Jdk Application

6
Sun / Jre Application

≤ 1.4.2_18
Sun / Jre Application

≤ 5.0
Sun / Jre Application

≤ 6
Sun / Jre Application

1.4.2_1
Sun / Jre Application

1.4.2_2
Sun / Jre Application

1.4.2_3
Sun / Jre Application

1.4.2_4
Sun / Jre Application

1.4.2_5
Sun / Jre Application

1.4.2_6
Sun / Jre Application

1.4.2_7
Sun / Jre Application

1.4.2_8
Sun / Jre Application

1.4.2_9
Sun / Jre Application

1.4.2_10
Sun / Jre Application

1.4.2_11
Sun / Jre Application

1.4.2_12
Sun / Jre Application

1.4.2_13
Sun / Jre Application

1.4.2_14
Sun / Jre Application

1.4.2_15
Sun / Jre Application

1.4.2_16
Sun / Jre Application

1.4.2_17
Sun / Jre Application

5.0
Sun / Jre Application

5.0
Sun / Jre Application

5.0
Sun / Jre Application

5.0
Sun / Jre Application

5.0
Sun / Jre Application

5.0
Sun / Jre Application

5.0
Sun / Jre Application

5.0
Sun / Jre Application

5.0
Sun / Jre Application

5.0
Sun / Jre Application

5.0
Sun / Jre Application

5.0
Sun / Jre Application

5.0
Sun / Jre Application

5.0
Sun / Jre Application

5.0
Sun / Jre Application

5.0
Sun / Jre Application

6
Sun / Jre Application

6
Sun / Jre Application

6
Sun / Jre Application

6
Sun / Jre Application

6
Sun / Jre Application

6
Sun / Jre Application

6
Sun / Jre Application

6
Sun / Jre Application

6
Sun / Jre Application

6
Sun / Sdk Application

≤ 1.4.2_18
Sun / Sdk Application

1.4.2_1
Sun / Sdk Application

1.4.2_2
Sun / Sdk Application

1.4.2_3
Sun / Sdk Application

1.4.2_4
Sun / Sdk Application

1.4.2_5
Sun / Sdk Application

1.4.2_6
Sun / Sdk Application

1.4.2_7
Sun / Sdk Application

1.4.2_8
Sun / Sdk Application

1.4.2_9
Sun / Sdk Application

1.4.2_10
Sun / Sdk Application

1.4.2_11
Sun / Sdk Application

1.4.2_12
Sun / Sdk Application

1.4.2_13
Sun / Sdk Application

1.4.2_14
Sun / Sdk Application

1.4.2_15
Sun / Sdk Application

1.4.2_16
Sun / Sdk Application

1.4.2_17

Extras for RHEL 3

java-1.4.2-ibm-0:1.4.2.13-1jpp.1.el3

Fixed · RHSA-2009:0445
Extras for RHEL 4

java-1.4.2-ibm-0:1.4.2.13-1jpp.1.el4

Fixed · RHSA-2009:0445
Extras for RHEL 4

java-1.5.0-ibm-1:1.5.0.9-1jpp.4.el4

Fixed · RHSA-2009:0016
Extras for RHEL 4

java-1.5.0-sun-0:1.5.0.17-1jpp.2.el4

Fixed · RHSA-2008:1025
Extras for RHEL 4

java-1.6.0-ibm-1:1.6.0.4-1jpp.1.el4

Fixed · RHSA-2009:0369
Extras for RHEL 4

java-1.6.0-sun-1:1.6.0.11-1jpp.1.el4

Fixed · RHSA-2008:1018
Red Hat Network Satellite Server v 5.2

java-1.5.0-ibm-1:1.5.0.9-1jpp.2.el5

Fixed · RHSA-2009:0466
Supplementary for Red Hat Enterprise Linux 5

java-1.4.2-ibm-0:1.4.2.13-1jpp.1.el5

Fixed · RHSA-2009:0445
Supplementary for Red Hat Enterprise Linux 5

java-1.5.0-ibm-1:1.5.0.9-1jpp.2.el5

Fixed · RHSA-2009:0016
Supplementary for Red Hat Enterprise Linux 5

java-1.5.0-sun-0:1.5.0.17-1jpp.2.el5

Fixed · RHSA-2008:1025
Supplementary for Red Hat Enterprise Linux 5

java-1.6.0-ibm-1:1.6.0.4-1jpp.1.el5

Fixed · RHSA-2009:0369
Supplementary for Red Hat Enterprise Linux 5

java-1.6.0-sun-1:1.6.0.11-1jpp.1.el5

Fixed · RHSA-2008:1018

Product	Package	State	Advisory
Extras for RHEL 3	java-1.4.2-ibm-0:1.4.2.13-1jpp.1.el3	Fixed	RHSA-2009:0445
Extras for RHEL 4	java-1.4.2-ibm-0:1.4.2.13-1jpp.1.el4	Fixed	RHSA-2009:0445
Extras for RHEL 4	java-1.5.0-ibm-1:1.5.0.9-1jpp.4.el4	Fixed	RHSA-2009:0016
Extras for RHEL 4	java-1.5.0-sun-0:1.5.0.17-1jpp.2.el4	Fixed	RHSA-2008:1025
Extras for RHEL 4	java-1.6.0-ibm-1:1.6.0.4-1jpp.1.el4	Fixed	RHSA-2009:0369
Extras for RHEL 4	java-1.6.0-sun-1:1.6.0.11-1jpp.1.el4	Fixed	RHSA-2008:1018
Red Hat Network Satellite Server v 5.2	java-1.5.0-ibm-1:1.5.0.9-1jpp.2.el5	Fixed	RHSA-2009:0466
Supplementary for Red Hat Enterprise Linux 5	java-1.4.2-ibm-0:1.4.2.13-1jpp.1.el5	Fixed	RHSA-2009:0445
Supplementary for Red Hat Enterprise Linux 5	java-1.5.0-ibm-1:1.5.0.9-1jpp.2.el5	Fixed	RHSA-2009:0016
Supplementary for Red Hat Enterprise Linux 5	java-1.5.0-sun-0:1.5.0.17-1jpp.2.el5	Fixed	RHSA-2008:1025
Supplementary for Red Hat Enterprise Linux 5	java-1.6.0-ibm-1:1.6.0.4-1jpp.1.el5	Fixed	RHSA-2009:0369
Supplementary for Red Hat Enterprise Linux 5	java-1.6.0-sun-1:1.6.0.11-1jpp.1.el5	Fixed	RHSA-2008:1018

Remediation

No remediation recorded yet.

Metrics

3.43% 0.03426

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.03426

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (11 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	3.43% (0.03426)	88.52th	v5 (v2026.06.15)
Jun 15, 2026	3.43% (0.03426)	87.33th	v5 (v2026.06.15)
Mar 30, 2025	2.88% (0.02884)	85.08th	v4 (v2025.03.14)
Mar 29, 2025	5.87% (0.05865)	83.85th	v4 (v2025.03.14)
Mar 17, 2025	2.31% (0.02314)	83.65th	v4 (v2025.03.14)
Dec 12, 2024	1.72% (0.01720)	88.33th	v3 (v2023.03.01)
Jun 13, 2024	1.72% (0.01720)	87.88th	v3 (v2023.03.01)
Mar 7, 2023	1.72% (0.01720)	85.87th	v3 (v2023.03.01)
Mar 6, 2023	2.69% (0.02686)	82.85th	v2 (v2022.01.01)
Apr 1, 2022	2.69% (0.02686)	81.17th	v2 (v2022.01.01)
Feb 4, 2022	2.69% (0.02686)	62.66th	v2 (v2022.01.01)

Weaknesses (1)

CWE-264

References (41)

http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
vendor-advisoryx_refsource_SUSE
http://marc.info/?l=bugtraq&m=123678756409861&w=2
vendor-advisoryx_refsource_HP
http://marc.info/?l=bugtraq&m=126583436323697&w=2
vendor-advisoryx_refsource_HP
http://osvdb.org/50502
vdb-entryx_refsource_OSVDB
http://rhn.redhat.com/errata/RHSA-2008-1018.html
vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2008-1025.html
vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/32991
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/33015
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/33709
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/33710
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/34233
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/34259
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/34447
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/34605
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/34889
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/34972
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/35065
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/37386
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/38539
third-party-advisoryx_refsource_SECUNIA
http://security.gentoo.org/glsa/glsa-200911-02.xml
vendor-advisoryx_refsource_GENTOO
http://sunsolve.sun.com/search/document.do?assetkey=1-26-245246-1
vendor-advisoryx_refsource_SUNALERTPatchVendor Advisory
http://support.avaya.com/elmodocs2/security/ASA-2009-012.htm
x_refsource_CONFIRM
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=829914&poid=
x_refsource_CONFIRM
http://www.redhat.com/support/errata/RHSA-2009-0016.html
vendor-advisoryx_refsource_REDHAT
http://www.redhat.com/support/errata/RHSA-2009-0369.html
vendor-advisoryx_refsource_REDHAT
http://www.redhat.com/support/errata/RHSA-2009-0445.html
vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/32608
vdb-entryx_refsource_BID
http://www.securitytracker.com/id?1021311
vdb-entryx_refsource_SECTRACK
http://www.us-cert.gov/cas/techalerts/TA08-340A.html
third-party-advisoryx_refsource_CERTUS Government Resource
http://www.vupen.com/english/advisories/2008/3339
vdb-entryx_refsource_VUPEN
http://www.vupen.com/english/advisories/2009/0672
vdb-entryx_refsource_VUPEN
http://www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2009/03/024431-01.pdf
x_refsource_CONFIRM
https://access.redhat.com/security/cve/CVE-2008-5351
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=472213
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2008-5351
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6212
vdb-entrysignaturex_refsource_OVAL
https://rhn.redhat.com/errata/RHSA-2009-0466.html
vendor-advisoryx_refsource_REDHAT
https://www.cve.org/CVERecord?id=CVE-2008-5351

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00009.html		vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html		vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00004.html		vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html		vendor-advisoryx_refsource_SUSE
http://marc.info/?l=bugtraq&m=123678756409861&w=2		vendor-advisoryx_refsource_HP
http://marc.info/?l=bugtraq&m=126583436323697&w=2		vendor-advisoryx_refsource_HP
http://osvdb.org/50502		vdb-entryx_refsource_OSVDB
http://rhn.redhat.com/errata/RHSA-2008-1018.html		vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2008-1025.html		vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/32991		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/33015		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/33709		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/33710		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/34233		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/34259		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/34447		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/34605		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/34889		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/34972		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/35065		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/37386		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/38539		third-party-advisoryx_refsource_SECUNIA
http://security.gentoo.org/glsa/glsa-200911-02.xml		vendor-advisoryx_refsource_GENTOO
http://sunsolve.sun.com/search/document.do?assetkey=1-26-245246-1		vendor-advisoryx_refsource_SUNALERTPatchVendor Advisory
http://support.avaya.com/elmodocs2/security/ASA-2009-012.htm		x_refsource_CONFIRM
http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=829914&poid=		x_refsource_CONFIRM
http://www.redhat.com/support/errata/RHSA-2009-0016.html		vendor-advisoryx_refsource_REDHAT
http://www.redhat.com/support/errata/RHSA-2009-0369.html		vendor-advisoryx_refsource_REDHAT
http://www.redhat.com/support/errata/RHSA-2009-0445.html		vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/32608		vdb-entryx_refsource_BID
http://www.securitytracker.com/id?1021311		vdb-entryx_refsource_SECTRACK
http://www.us-cert.gov/cas/techalerts/TA08-340A.html		third-party-advisoryx_refsource_CERTUS Government Resource
http://www.vupen.com/english/advisories/2008/3339		vdb-entryx_refsource_VUPEN
http://www.vupen.com/english/advisories/2009/0672		vdb-entryx_refsource_VUPEN
http://www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2009/03/024431-01.pdf		x_refsource_CONFIRM
https://access.redhat.com/security/cve/CVE-2008-5351		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=472213		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2008-5351
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6212		vdb-entrysignaturex_refsource_OVAL
https://rhn.redhat.com/errata/RHSA-2009-0466.html		vendor-advisoryx_refsource_REDHAT
https://www.cve.org/CVERecord?id=CVE-2008-5351

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Dec 5, 2008

Updated Aug 7, 2024

Reserved Dec 4, 2008

Link CVE-2008-5351

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2008-5351

Red Hat

Severity Important

Public date Dec 4, 2008

Links CVE-2008-5351 - Bugzilla