Change to loop-limit adjustments introduced a possible overflow in the computation of loop limits.
OpenJDK-8 upstream commit: https://github.com/openjdk/jdk8u/commit/949c6ffc54efaa92d6559a3e7897432b95e99253 OpenJDK-11 upstream commit: https://github.com/openjdk/jdk11u/commit/2b70822671cf5f9b37956949421e7c77da082c8e OpenJDK-17 upstream commit: https://github.com/openjdk/jdk17u/commit/5b0a5f436fb9817d679f64302b37543bf160d43d OpenJDK-21 upstream commit: https://github.com/openjdk/jdk21u/commit/11067d7e975ce71bedbfdd314519ec9ff689a7e7
This CVE was fixed in Oracle Java SE 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1. Release notes: https://www.oracle.com/java/technologies/javase/8u451-relnotes.html#R180_451 https://www.oracle.com/java/technologies/javase/8u451-perf-relnotes.html https://www.oracle.com/java/technologies/javase/11-0-27-relnotes.html#R11_0_27 https://www.oracle.com/java/technologies/javase/17-0-15-relnotes.html#R17_0_15 https://www.oracle.com/java/technologies/javase/21-0-7-relnotes.html https://www.oracle.com/java/technologies/javase/24-0-1-relnotes.html