Skip to content
Fencer Vulns
low 3.7

CVE-2024-21098 json

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler).

published 2024-04-16 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-18812

cvss
3.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle GraalVM for JDK: 17.0.10, 21.0.2, 22; Oracle GraalVM Enterprise Edition: 20.3.13 and 21.3.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

Patch / fix

  • oracle graalvm 17.0.11, 21.0.3, 22.0.1
  • oracle graalvm_for_jdk 17.0.11, 21.0.3, 22.0.1
  • oracle graalvm_enterprise 20.3.14, 21.3.10
  • quarkus-mandrel-java quarkus 3.8 23.1.3.1_1-13.redhat_00001.1.el8qks
  • quarkus-mandrel-java-jdk-21-binding quarkus 3.8 23.1.3.1_1-13.redhat_00001.1.el8qks
  • quarkus-mandrel-java quarkus 3.2 23.0.4.1_1-10.redhat_00001.1.el8qks
  • quarkus-mandrel-java-jdk-17-binding quarkus 3.2 23.0.4.1_1-10.redhat_00001.1.el8qks

red hat advisories RHSA-2024:4079RHSA-2024:4081

  • openjdk17 Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 17.0.11_p9-r0
  • openjdk21 Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 21.0.3_p9-r0

alpine advisories ALPINE-CVE-2024-21098

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-21098 updated cvss 3.7

graalvm: unauthorized ability to cause a partial denial of service

  • Red Hat build of Quarkus 3.2 quarkus-mandrel-java 23.0.4.1_1-10.redhat_00001.1.el8qks, quarkus-mandrel-java-jdk-17-binding 23.0.4.1_1-10.redhat_00001.1.el8qks
    fixed: vendor fix “No current mitigation is available for this vulnerability.” RHSA-2024:4081
  • Red Hat build of Quarkus 3.8 quarkus-mandrel-java 23.1.3.1_1-13.redhat_00001.1.el8qks, quarkus-mandrel-java-jdk-21-binding 23.1.3.1_1-13.redhat_00001.1.el8qks
    fixed: vendor fix “No current mitigation is available for this vulnerability.” RHSA-2024:4079
  • Red Hat RHINT Camel-K 1.10.9
    fixed: vendor fix “No current mitigation is available for this vulnerability.” RHSA-2025:1154
  • Red Hat build of Quarkus graal-sdk Red Hat build of Quarkus 3.2 quarkus-mandrel-23 23.0.4.1_1-4.el8qks Red Hat build of Quarkus 3.8 quarkus-mandrel-231 23.1.3.1_1-5.el8qks
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

  • Oracle Corporation GraalVM

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.