CVE-2022-39399 — OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366)

Back Back to CVE browser

LOW

OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366)

Published Oct 18, 2022

3.7

LOW

CVSS 3.1

EPSS 1.65%

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

Affected products

Vendor Oracle Corporation Product Java SE JDK and JRE Default
n/a
- Version
  Oracle GraalVM Enterprise Edition:20.3.7
  Status
  affected
  Constraints
  -
- Version
  Oracle GraalVM Enterprise Edition:21.3.3
  Status
  affected
  Constraints
  -
- Version
  Oracle GraalVM Enterprise Edition:22.2.0
  Status
  affected
  Constraints
  -
- Version
  Oracle Java SE:11.0.16.1
  Status
  affected
  Constraints
  -
- Version
  Oracle Java SE:17.0.4.1
  Status
  affected
  Constraints
  -
- Version
  Oracle Java SE:19
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Oracle Corporation

Java SE JDK and JRE

n/a

Version	Status	Constraints
Oracle GraalVM Enterprise Edition:20.3.7	affected	-
Oracle GraalVM Enterprise Edition:21.3.3	affected	-
Oracle GraalVM Enterprise Edition:22.2.0	affected	-
Oracle Java SE:11.0.16.1	affected	-
Oracle Java SE:17.0.4.1	affected	-
Oracle Java SE:19	affected	-

Red Hat Build of OpenJDK 17.0.5

n/a

Fixed · RHSA-2022:7053
Red Hat Enterprise Linux 7

java-11-openjdk-1:11.0.17.0.8-2.el7_9

Fixed · RHSA-2022:7008
Red Hat Enterprise Linux 8

java-11-openjdk-1:11.0.17.0.8-2.el8_6

Fixed · RHSA-2022:7012
Red Hat Enterprise Linux 8

java-17-openjdk-1:17.0.5.0.8-2.el8_6

Fixed · RHSA-2022:7000
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

java-11-openjdk-1:11.0.17.0.8-2.el8_1

Fixed · RHSA-2022:7009
Red Hat Enterprise Linux 8.2 Extended Update Support

java-11-openjdk-1:11.0.17.0.8-2.el8_2

Fixed · RHSA-2022:7010
Red Hat Enterprise Linux 8.4 Extended Update Support

java-11-openjdk-1:11.0.17.0.8-2.el8_4

Fixed · RHSA-2022:7011
Red Hat Enterprise Linux 8.4 Extended Update Support

java-17-openjdk-1:17.0.5.0.8-2.el8_4

Fixed · RHSA-2022:7001
Red Hat Enterprise Linux 9

java-11-openjdk-1:11.0.17.0.8-2.el9_0

Fixed · RHSA-2022:7013
Red Hat Enterprise Linux 9

java-17-openjdk-1:17.0.5.0.8-2.el9_0

Fixed · RHSA-2022:6999
Red Hat Enterprise Linux 6

java-1.6.0-openjdk

Not affected
Red Hat Enterprise Linux 6

java-1.7.0-openjdk

Not affected
Red Hat Enterprise Linux 6

java-1.8.0-openjdk

Not affected
Red Hat Enterprise Linux 7

java-1.6.0-openjdk

Not affected
Red Hat Enterprise Linux 7

java-1.7.0-openjdk

Not affected
Red Hat Enterprise Linux 7

java-1.7.1-ibm

Not affected
Red Hat Enterprise Linux 7

java-1.8.0-ibm

Not affected
Red Hat Enterprise Linux 7

java-1.8.0-openjdk

Not affected
Red Hat Enterprise Linux 8

java-1.8.0-ibm

Not affected
Red Hat Enterprise Linux 8

java-1.8.0-openjdk

Not affected
Red Hat Enterprise Linux 9

java-1.8.0-openjdk

Not affected
Red Hat build of OpenJDK 1.8

Linux

Not affected
Red Hat build of OpenJDK 1.8

Windows

Not affected

Product	Package	State	Advisory
Red Hat Build of OpenJDK 17.0.5	n/a	Fixed	RHSA-2022:7053
Red Hat Enterprise Linux 7	java-11-openjdk-1:11.0.17.0.8-2.el7_9	Fixed	RHSA-2022:7008
Red Hat Enterprise Linux 8	java-11-openjdk-1:11.0.17.0.8-2.el8_6	Fixed	RHSA-2022:7012
Red Hat Enterprise Linux 8	java-17-openjdk-1:17.0.5.0.8-2.el8_6	Fixed	RHSA-2022:7000
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions	java-11-openjdk-1:11.0.17.0.8-2.el8_1	Fixed	RHSA-2022:7009
Red Hat Enterprise Linux 8.2 Extended Update Support	java-11-openjdk-1:11.0.17.0.8-2.el8_2	Fixed	RHSA-2022:7010
Red Hat Enterprise Linux 8.4 Extended Update Support	java-11-openjdk-1:11.0.17.0.8-2.el8_4	Fixed	RHSA-2022:7011
Red Hat Enterprise Linux 8.4 Extended Update Support	java-17-openjdk-1:17.0.5.0.8-2.el8_4	Fixed	RHSA-2022:7001
Red Hat Enterprise Linux 9	java-11-openjdk-1:11.0.17.0.8-2.el9_0	Fixed	RHSA-2022:7013
Red Hat Enterprise Linux 9	java-17-openjdk-1:17.0.5.0.8-2.el9_0	Fixed	RHSA-2022:6999
Red Hat Enterprise Linux 6	java-1.6.0-openjdk	Not affected	n/a
Red Hat Enterprise Linux 6	java-1.7.0-openjdk	Not affected	n/a
Red Hat Enterprise Linux 6	java-1.8.0-openjdk	Not affected	n/a
Red Hat Enterprise Linux 7	java-1.6.0-openjdk	Not affected	n/a
Red Hat Enterprise Linux 7	java-1.7.0-openjdk	Not affected	n/a
Red Hat Enterprise Linux 7	java-1.7.1-ibm	Not affected	n/a
Red Hat Enterprise Linux 7	java-1.8.0-ibm	Not affected	n/a
Red Hat Enterprise Linux 7	java-1.8.0-openjdk	Not affected	n/a
Red Hat Enterprise Linux 8	java-1.8.0-ibm	Not affected	n/a
Red Hat Enterprise Linux 8	java-1.8.0-openjdk	Not affected	n/a
Red Hat Enterprise Linux 9	java-1.8.0-openjdk	Not affected	n/a
Red Hat build of OpenJDK 1.8	Linux	Not affected	n/a
Red Hat build of OpenJDK 1.8	Windows	Not affected	n/a

Remediation

No remediation recorded yet.

Metrics

1.65% 0.01645

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01645

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (12 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.65% (0.01645)	75.58th	v5 (v2026.06.15)
Jun 15, 2026	1.20% (0.01203)	64.12th	v5 (v2026.06.15)
Mar 17, 2025	0.19% (0.00190)	38.70th	v4 (v2025.03.14)
Dec 12, 2024	0.09% (0.00094)	41.52th	v3 (v2023.03.01)
Mar 30, 2024	0.09% (0.00094)	38.78th	v3 (v2023.03.01)
Jan 24, 2024	0.08% (0.00079)	33.00th	v3 (v2023.03.01)
Nov 20, 2023	0.07% (0.00073)	30.79th	v3 (v2023.03.01)
Oct 25, 2023	0.07% (0.00068)	28.32th	v3 (v2023.03.01)
Mar 7, 2023	0.06% (0.00061)	24.03th	v3 (v2023.03.01)
Mar 6, 2023	1.02% (0.01018)	40.69th	v2 (v2022.01.01)
Nov 4, 2022	1.02% (0.01018)	39.45th	v2 (v2022.01.01)
Oct 19, 2022	0.89% (0.00885)	26.66th	v2 (v2022.01.01)

Weaknesses (2)

CWE-284

CWE-290

Authentication Bypass by Spoofing

References (9)

https://access.redhat.com/security/cve/CVE-2022-39399
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2133776
Issue Tracking
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37QDWJBGEPP65X43NXQTXQ7KASLUHON6/
vendor-advisoryMailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXSBV3W6EP6B7XJ63Z2FPVBH6HAPGJ5T/
vendor-advisoryMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-39399
https://security.gentoo.org/glsa/202401-25
https://security.netapp.com/advisory/ntap-20221028-0012/
Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-39399
https://www.oracle.com/security-alerts/cpuoct2022.html
PatchVendor Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-39399		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2133776		Issue Tracking
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37QDWJBGEPP65X43NXQTXQ7KASLUHON6/		vendor-advisoryMailing ListThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXSBV3W6EP6B7XJ63Z2FPVBH6HAPGJ5T/		vendor-advisoryMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-39399
https://security.gentoo.org/glsa/202401-25
https://security.netapp.com/advisory/ntap-20221028-0012/		Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-39399
https://www.oracle.com/security-alerts/cpuoct2022.html		PatchVendor Advisory