OpenJDK: Unbounded memory allocation during deserialization in Collections (Utilities, 8213432)
Published Jul 23, 2019
5.3
MEDIUMCVSS 3.1
EPSS 4.35%
Description
Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Affected products
-
- Version Java SE Embedded: 8u211StatusaffectedConstraints-
- Version Java SE: 7u221, 8u212, 11.0.3, 12.0.1StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Oracle Corporation | Java | n/a |
|
Configuration 1
- 1.7.0
- 1.8.0
- 1.8.0
- 11.0.3
- 12.0.1
- 1.7.0
- 1.8.0
- 1.8.0
- 11.0.3
- 12.0.1
Configuration 2
- 8.0
Configuration 3
- 16.04
- 18.04
- 19.04
Configuration 4
- 5.8
- 8.0
- 6.0
- 7.0
- 8.6
- 6.0
- 7.0
- 6.0
- 7.0
Configuration 5
- < 8.7.0-00
Configuration 6
- 5.9.0
- 5.9.1
- 5.10.0
- 5.10.0
- 5.10.0
- 5.10.0
- 5.10.0
No data.
Red Hat Enterprise Linux 6
java-1.7.0-openjdk-1:1.7.0.231-2.6.19.1.el6_10
Fixed · RHSA-2019:1840
Red Hat Enterprise Linux 6
java-1.8.0-openjdk-1:1.8.0.222.b10-0.el6_10
Fixed · RHSA-2019:1811
Red Hat Enterprise Linux 6 Supplementary
java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10
Fixed · RHSA-2019:2494
Red Hat Enterprise Linux 6 Supplementary
java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10
Fixed · RHSA-2019:2592
Red Hat Enterprise Linux 7
java-1.7.0-openjdk-1:1.7.0.231-2.6.19.1.el7_6
Fixed · RHSA-2019:1839
Red Hat Enterprise Linux 7
java-1.8.0-openjdk-1:1.8.0.222.b10-0.el7_6
Fixed · RHSA-2019:1815
Red Hat Enterprise Linux 7
java-11-openjdk-1:11.0.4.11-0.el7_6
Fixed · RHSA-2019:1810
Red Hat Enterprise Linux 7 Supplementary
java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7
Fixed · RHSA-2019:2495
Red Hat Enterprise Linux 7 Supplementary
java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7
Fixed · RHSA-2019:2585
Red Hat Enterprise Linux 8
java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0
Fixed · RHSA-2019:2590
Red Hat Enterprise Linux 8
java-1.8.0-openjdk-1:1.8.0.222.b10-0.el8_0
Fixed · RHSA-2019:1816
Red Hat Enterprise Linux 8
java-11-openjdk-1:11.0.4.11-0.el8_0
Fixed · RHSA-2019:1817
Red Hat Satellite 5.8
java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10
Fixed · RHSA-2019:2737
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 | java-1.7.0-openjdk-1:1.7.0.231-2.6.19.1.el6_10 | Fixed | RHSA-2019:1840 |
| Red Hat Enterprise Linux 6 | java-1.8.0-openjdk-1:1.8.0.222.b10-0.el6_10 | Fixed | RHSA-2019:1811 |
| Red Hat Enterprise Linux 6 Supplementary | java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el6_10 | Fixed | RHSA-2019:2494 |
| Red Hat Enterprise Linux 6 Supplementary | java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10 | Fixed | RHSA-2019:2592 |
| Red Hat Enterprise Linux 7 | java-1.7.0-openjdk-1:1.7.0.231-2.6.19.1.el7_6 | Fixed | RHSA-2019:1839 |
| Red Hat Enterprise Linux 7 | java-1.8.0-openjdk-1:1.8.0.222.b10-0.el7_6 | Fixed | RHSA-2019:1815 |
| Red Hat Enterprise Linux 7 | java-11-openjdk-1:11.0.4.11-0.el7_6 | Fixed | RHSA-2019:1810 |
| Red Hat Enterprise Linux 7 Supplementary | java-1.7.1-ibm-1:1.7.1.4.50-1jpp.1.el7 | Fixed | RHSA-2019:2495 |
| Red Hat Enterprise Linux 7 Supplementary | java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el7 | Fixed | RHSA-2019:2585 |
| Red Hat Enterprise Linux 8 | java-1.8.0-ibm-1:1.8.0.5.40-3.el8_0 | Fixed | RHSA-2019:2590 |
| Red Hat Enterprise Linux 8 | java-1.8.0-openjdk-1:1.8.0.222.b10-0.el8_0 | Fixed | RHSA-2019:1816 |
| Red Hat Enterprise Linux 8 | java-11-openjdk-1:11.0.4.11-0.el8_0 | Fixed | RHSA-2019:1817 |
| Red Hat Satellite 5.8 | java-1.8.0-ibm-1:1.8.0.5.40-1jpp.1.el6_10 | Fixed | RHSA-2019:2737 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
AV:N/AC:L/Au:N/C:N/I:N/A:P
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
YesTechnical Impact
PartialDecision
n/aAssessed Oct 15, 2024 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v5
- EPSS v2
- EPSS v3
- EPSS v4
Percentile over time
- EPSS v1
- EPSS v5
- EPSS v2
- EPSS v3
- EPSS v4
Table of values (15 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 4.35% (0.04351) | 90.92th | v5 (v2026.06.15) |
| Jun 15, 2026 | 4.47% (0.04472) | 90.19th | v5 (v2026.06.15) |
| Mar 17, 2025 | 0.15% (0.00148) | 32.76th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.30% (0.00298) | 70.23th | v3 (v2023.03.01) |
| Jul 16, 2024 | 0.30% (0.00298) | 69.69th | v3 (v2023.03.01) |
| Jul 1, 2024 | 0.20% (0.00200) | 57.86th | v3 (v2023.03.01) |
| Sep 3, 2023 | 0.14% (0.00141) | 49.11th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.10% (0.00103) | 40.47th | v3 (v2023.03.01) |
| Mar 6, 2023 | 2.69% (0.02686) | 82.85th | v2 (v2022.01.01) |
| Apr 1, 2022 | 2.69% (0.02686) | 81.17th | v2 (v2022.01.01) |
| Feb 4, 2022 | 27.30% (0.27302) | 95.86th | v2 (v2022.01.01) |
| Feb 3, 2022 | 15.89% (0.15893) | 90.15th | v1 |
| Jan 6, 2022 | 15.89% (0.15893) | 90.03th | v1 |
| Jan 5, 2022 | 4.04% (0.04041) | 83.67th | v5 (v2026.06.15) |
| Apr 14, 2021 | 4.04% (0.04041) | 0.00th | v1 |
References (18)
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00038.html vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00044.html vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html x_refsource_MISCPatchVendor Advisory
- https://access.redhat.com/errata/RHSA-2019:2494 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2495 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2585 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2590 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2592 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2737 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2019-2769 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1730056 Issue Tracking
- https://kc.mcafee.com/corporate/index?page=content&id=SB10300 x_refsource_CONFIRMThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/08/msg00020.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-2769
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03977en_us x_refsource_CONFIRMThird Party Advisory
- https://usn.ubuntu.com/4080-1/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://usn.ubuntu.com/4083-1/ vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2019-2769
Change history (0)
No recorded changes yet.