When the server terminates the TLS connection by sending a close_notify alert, but then writes additional data over the same TCP connection before closing, the thread gets stuck at 100% CPU.
This CVE was fixed in Oracle Java SE 11.0.31, 17.0.19, 21.0.11, 25.0.3. https://www.oracle.com/java/technologies/javase/11-0-31-relnotes.html#R11_0_31 https://www.oracle.com/java/technologies/javase/17-0-19-relnotes.html#R17_0_19 https://www.oracle.com/java/technologies/javase/21-0-11-relnotes.html https://www.oracle.com/java/technologies/javase/25-0-3-relnotes.html
OpenJDK-11 upstream commit: https://github.com/openjdk/jdk11u/commit/acd581e8cbd48a51470e6363f9d6715c49c68646 OpenJDK-17 upstream commit: https://github.com/openjdk/jdk17u/commit/5b42bce259cac40639328cd608f83bf7f7894632 OpenJDK-21 upstream commit: https://github.com/openjdk/jdk21u/commit/7713f5d059616ac459c49042e17e79077f29d881 OpenJDK-25 upstream commit: https://github.com/openjdk/jdk25u/commit/ccf8a461821cfe0700403418d0e789b7fd7ed049
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 10.2 Extended Update Support Via RHSA-2026:22328 https://access.redhat.com/errata/RHSA-2026:22328