[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiqDgo40oz80rLNdt73WYA25PhK4N9xstQau7HiSeuW4":3,"g5a-family:oracle\u002Fgraalvm":333,"g5a-ex:oracle\u002Fgraalvm@*":337},{"success":4,"data":5},true,{"product":6,"versions":173,"topVulnerabilitiesByEpss":245,"kevVulnerabilities":300,"seoMetadata":311,"meta":330},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":172},"oracle","graalvm",71,164,1,"2025-04-15",[14,18,21,23,25,27,30,32,34,36,39,42,45,47,49,52,54,56,58,60,62,64,66,68,70,72,74,77,80,83,85,87,89,92,95,98,100,102,104,106,108,110,112,114,117,119,121,123,125,127,129,131,133,135,137,139,141,143,145,147,149,151,154,156,158,160,162,164,166,168,170],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},"17.0.11",0,false,{"version":19,"cve_count":20,"kev_count":16,"has_kev":17},"19.0.0",2,{"version":22,"cve_count":16,"kev_count":16,"has_kev":17},"19.0.2",{"version":24,"cve_count":16,"kev_count":16,"has_kev":17},"19.1.0",{"version":26,"cve_count":16,"kev_count":16,"has_kev":17},"19.1.1",{"version":28,"cve_count":29,"kev_count":16,"has_kev":17},"19.2.0",9,{"version":31,"cve_count":16,"kev_count":16,"has_kev":17},"19.2.0.1",{"version":33,"cve_count":16,"kev_count":16,"has_kev":17},"19.2.1",{"version":35,"cve_count":16,"kev_count":16,"has_kev":17},"19.3.0",{"version":37,"cve_count":38,"kev_count":16,"has_kev":17},"19.3.0.2",7,{"version":40,"cve_count":41,"kev_count":16,"has_kev":17},"19.3.1",6,{"version":43,"cve_count":44,"kev_count":16,"has_kev":17},"19.3.2",5,{"version":46,"cve_count":11,"kev_count":16,"has_kev":17},"19.3.3",{"version":48,"cve_count":44,"kev_count":16,"has_kev":17},"19.3.4",{"version":50,"cve_count":51,"kev_count":16,"has_kev":17},"19.3.5",10,{"version":53,"cve_count":16,"kev_count":16,"has_kev":17},"19.3.6",{"version":55,"cve_count":41,"kev_count":16,"has_kev":17},"20.0.0",{"version":57,"cve_count":16,"kev_count":16,"has_kev":17},"20.0.1",{"version":59,"cve_count":44,"kev_count":16,"has_kev":17},"20.1.0",{"version":61,"cve_count":11,"kev_count":16,"has_kev":17},"20.2.0",{"version":63,"cve_count":44,"kev_count":16,"has_kev":17},"20.3.0",{"version":65,"cve_count":16,"kev_count":16,"has_kev":17},"20.3.1",{"version":67,"cve_count":44,"kev_count":16,"has_kev":17},"20.3.10",{"version":69,"cve_count":16,"kev_count":16,"has_kev":17},"20.3.11",{"version":71,"cve_count":51,"kev_count":16,"has_kev":17},"20.3.1.2",{"version":73,"cve_count":51,"kev_count":16,"has_kev":17},"20.3.12",{"version":75,"cve_count":76,"kev_count":11,"has_kev":4},"20.3.13",11,{"version":78,"cve_count":79,"kev_count":16,"has_kev":17},"20.3.14",4,{"version":81,"cve_count":82,"kev_count":16,"has_kev":17},"20.3.15",3,{"version":84,"cve_count":16,"kev_count":16,"has_kev":17},"20.3.16",{"version":86,"cve_count":20,"kev_count":16,"has_kev":17},"20.3.17",{"version":88,"cve_count":44,"kev_count":16,"has_kev":17},"20.3.2",{"version":90,"cve_count":91,"kev_count":16,"has_kev":17},"20.3.3",23,{"version":93,"cve_count":94,"kev_count":16,"has_kev":17},"20.3.4",21,{"version":96,"cve_count":97,"kev_count":16,"has_kev":17},"20.3.5",8,{"version":99,"cve_count":79,"kev_count":16,"has_kev":17},"20.3.6",{"version":101,"cve_count":38,"kev_count":16,"has_kev":17},"20.3.7",{"version":103,"cve_count":79,"kev_count":16,"has_kev":17},"20.3.8",{"version":105,"cve_count":38,"kev_count":16,"has_kev":17},"20.3.9",{"version":107,"cve_count":16,"kev_count":16,"has_kev":17},"21.0.0",{"version":109,"cve_count":51,"kev_count":16,"has_kev":17},"21.0.0.2",{"version":111,"cve_count":16,"kev_count":16,"has_kev":17},"21.0.3",{"version":113,"cve_count":44,"kev_count":16,"has_kev":17},"21.1.0",{"version":115,"cve_count":116,"kev_count":16,"has_kev":17},"21.2.0",22,{"version":118,"cve_count":11,"kev_count":16,"has_kev":17},"21.2.2",{"version":120,"cve_count":94,"kev_count":16,"has_kev":17},"21.3.0",{"version":122,"cve_count":29,"kev_count":16,"has_kev":17},"21.3.1",{"version":124,"cve_count":79,"kev_count":16,"has_kev":17},"21.3.10",{"version":126,"cve_count":82,"kev_count":16,"has_kev":17},"21.3.11",{"version":128,"cve_count":16,"kev_count":16,"has_kev":17},"21.3.12",{"version":130,"cve_count":20,"kev_count":16,"has_kev":17},"21.3.13",{"version":132,"cve_count":16,"kev_count":16,"has_kev":17},"21.3.14",{"version":134,"cve_count":16,"kev_count":16,"has_kev":17},"21.3.15",{"version":136,"cve_count":16,"kev_count":16,"has_kev":17},"21.3.16",{"version":138,"cve_count":44,"kev_count":16,"has_kev":17},"21.3.2",{"version":140,"cve_count":97,"kev_count":16,"has_kev":17},"21.3.3",{"version":142,"cve_count":79,"kev_count":16,"has_kev":17},"21.3.4",{"version":144,"cve_count":38,"kev_count":16,"has_kev":17},"21.3.5",{"version":146,"cve_count":38,"kev_count":16,"has_kev":17},"21.3.6",{"version":148,"cve_count":16,"kev_count":16,"has_kev":17},"21.3.7",{"version":150,"cve_count":76,"kev_count":16,"has_kev":17},"21.3.8",{"version":152,"cve_count":153,"kev_count":11,"has_kev":4},"21.3.9",12,{"version":155,"cve_count":29,"kev_count":16,"has_kev":17},"22.0.0.2",{"version":157,"cve_count":11,"kev_count":16,"has_kev":17},"22.0.1",{"version":159,"cve_count":44,"kev_count":16,"has_kev":17},"22.1.0",{"version":161,"cve_count":97,"kev_count":16,"has_kev":17},"22.2.0",{"version":163,"cve_count":79,"kev_count":16,"has_kev":17},"22.3.0",{"version":165,"cve_count":38,"kev_count":16,"has_kev":17},"22.3.1",{"version":167,"cve_count":38,"kev_count":16,"has_kev":17},"22.3.2",{"version":169,"cve_count":16,"kev_count":16,"has_kev":17},"22.3.3",{"version":171,"cve_count":97,"kev_count":16,"has_kev":17},"22.3.4","Graalvm by Oracle is a technology product with 71 tracked versions and 164 known security vulnerabilities including 1 CISA Known Exploited Vulnerability. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244],{"version":15,"cve_count":16,"kev_count":16,"has_kev":17},{"version":19,"cve_count":20,"kev_count":16,"has_kev":17},{"version":22,"cve_count":16,"kev_count":16,"has_kev":17},{"version":24,"cve_count":16,"kev_count":16,"has_kev":17},{"version":26,"cve_count":16,"kev_count":16,"has_kev":17},{"version":28,"cve_count":29,"kev_count":16,"has_kev":17},{"version":31,"cve_count":16,"kev_count":16,"has_kev":17},{"version":33,"cve_count":16,"kev_count":16,"has_kev":17},{"version":35,"cve_count":16,"kev_count":16,"has_kev":17},{"version":37,"cve_count":38,"kev_count":16,"has_kev":17},{"version":40,"cve_count":41,"kev_count":16,"has_kev":17},{"version":43,"cve_count":44,"kev_count":16,"has_kev":17},{"version":46,"cve_count":11,"kev_count":16,"has_kev":17},{"version":48,"cve_count":44,"kev_count":16,"has_kev":17},{"version":50,"cve_count":51,"kev_count":16,"has_kev":17},{"version":53,"cve_count":16,"kev_count":16,"has_kev":17},{"version":55,"cve_count":41,"kev_count":16,"has_kev":17},{"version":57,"cve_count":16,"kev_count":16,"has_kev":17},{"version":59,"cve_count":44,"kev_count":16,"has_kev":17},{"version":61,"cve_count":11,"kev_count":16,"has_kev":17},{"version":63,"cve_count":44,"kev_count":16,"has_kev":17},{"version":65,"cve_count":16,"kev_count":16,"has_kev":17},{"version":67,"cve_count":44,"kev_count":16,"has_kev":17},{"version":69,"cve_count":16,"kev_count":16,"has_kev":17},{"version":71,"cve_count":51,"kev_count":16,"has_kev":17},{"version":73,"cve_count":51,"kev_count":16,"has_kev":17},{"version":75,"cve_count":76,"kev_count":11,"has_kev":4},{"version":78,"cve_count":79,"kev_count":16,"has_kev":17},{"version":81,"cve_count":82,"kev_count":16,"has_kev":17},{"version":84,"cve_count":16,"kev_count":16,"has_kev":17},{"version":86,"cve_count":20,"kev_count":16,"has_kev":17},{"version":88,"cve_count":44,"kev_count":16,"has_kev":17},{"version":90,"cve_count":91,"kev_count":16,"has_kev":17},{"version":93,"cve_count":94,"kev_count":16,"has_kev":17},{"version":96,"cve_count":97,"kev_count":16,"has_kev":17},{"version":99,"cve_count":79,"kev_count":16,"has_kev":17},{"version":101,"cve_count":38,"kev_count":16,"has_kev":17},{"version":103,"cve_count":79,"kev_count":16,"has_kev":17},{"version":105,"cve_count":38,"kev_count":16,"has_kev":17},{"version":107,"cve_count":16,"kev_count":16,"has_kev":17},{"version":109,"cve_count":51,"kev_count":16,"has_kev":17},{"version":111,"cve_count":16,"kev_count":16,"has_kev":17},{"version":113,"cve_count":44,"kev_count":16,"has_kev":17},{"version":115,"cve_count":116,"kev_count":16,"has_kev":17},{"version":118,"cve_count":11,"kev_count":16,"has_kev":17},{"version":120,"cve_count":94,"kev_count":16,"has_kev":17},{"version":122,"cve_count":29,"kev_count":16,"has_kev":17},{"version":124,"cve_count":79,"kev_count":16,"has_kev":17},{"version":126,"cve_count":82,"kev_count":16,"has_kev":17},{"version":128,"cve_count":16,"kev_count":16,"has_kev":17},{"version":130,"cve_count":20,"kev_count":16,"has_kev":17},{"version":132,"cve_count":16,"kev_count":16,"has_kev":17},{"version":134,"cve_count":16,"kev_count":16,"has_kev":17},{"version":136,"cve_count":16,"kev_count":16,"has_kev":17},{"version":138,"cve_count":44,"kev_count":16,"has_kev":17},{"version":140,"cve_count":97,"kev_count":16,"has_kev":17},{"version":142,"cve_count":79,"kev_count":16,"has_kev":17},{"version":144,"cve_count":38,"kev_count":16,"has_kev":17},{"version":146,"cve_count":38,"kev_count":16,"has_kev":17},{"version":148,"cve_count":16,"kev_count":16,"has_kev":17},{"version":150,"cve_count":76,"kev_count":16,"has_kev":17},{"version":152,"cve_count":153,"kev_count":11,"has_kev":4},{"version":155,"cve_count":29,"kev_count":16,"has_kev":17},{"version":157,"cve_count":11,"kev_count":16,"has_kev":17},{"version":159,"cve_count":44,"kev_count":16,"has_kev":17},{"version":161,"cve_count":97,"kev_count":16,"has_kev":17},{"version":163,"cve_count":79,"kev_count":16,"has_kev":17},{"version":165,"cve_count":38,"kev_count":16,"has_kev":17},{"version":167,"cve_count":38,"kev_count":16,"has_kev":17},{"version":169,"cve_count":16,"kev_count":16,"has_kev":17},{"version":171,"cve_count":97,"kev_count":16,"has_kev":17},[246,254,258,263,267,272,277,284,291,295],{"cveId":247,"description":248,"publishedDate":249,"cvssScore":250,"cvssVersion":251,"severity":252,"isKev":17,"epssScore":253},"CVE-2019-9515","Some HTTP\u002F2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.","2019-08-13",7.5,"v3.1","High",0.87399,{"cveId":255,"description":256,"publishedDate":249,"cvssScore":250,"cvssVersion":251,"severity":252,"isKev":17,"epssScore":257},"CVE-2019-9514","Some HTTP\u002F2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.",0.82813,{"cveId":259,"description":260,"publishedDate":261,"cvssScore":250,"cvssVersion":251,"severity":252,"isKev":17,"epssScore":262},"CVE-2022-34169","The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan.","2022-07-19",0.81759,{"cveId":264,"description":265,"publishedDate":249,"cvssScore":250,"cvssVersion":251,"severity":252,"isKev":17,"epssScore":266},"CVE-2019-9513","Some HTTP\u002F2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.",0.81556,{"cveId":268,"description":269,"publishedDate":270,"cvssScore":250,"cvssVersion":251,"severity":252,"isKev":17,"epssScore":271},"CVE-2021-22883","Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.","2021-03-03",0.77385,{"cveId":273,"description":274,"publishedDate":275,"cvssScore":250,"cvssVersion":251,"severity":252,"isKev":17,"epssScore":276},"CVE-2022-21449","Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N).","2022-04-19",0.77151,{"cveId":278,"description":279,"publishedDate":280,"cvssScore":281,"cvssVersion":251,"severity":282,"isKev":17,"epssScore":283},"CVE-2020-7774","The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.","2020-11-17",9.8,"Critical",0.69377,{"cveId":285,"description":286,"publishedDate":287,"cvssScore":288,"cvssVersion":251,"severity":289,"isKev":17,"epssScore":290},"CVE-2021-3449","An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).","2021-03-25",5.9,"Medium",0.63542,{"cveId":292,"description":293,"publishedDate":249,"cvssScore":250,"cvssVersion":251,"severity":252,"isKev":17,"epssScore":294},"CVE-2019-9511","Some HTTP\u002F2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.",0.59547,{"cveId":296,"description":297,"publishedDate":298,"cvssScore":281,"cvssVersion":251,"severity":282,"isKev":17,"epssScore":299},"CVE-2019-15605","HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed","2020-02-07",0.57132,[301],{"cveId":302,"description":303,"publishedDate":304,"cvssScore":305,"severity":252,"isKev":4,"epssScore":306,"cisaVulnName":307,"cisaDateAdded":308,"cisaShortDescription":309,"cisaRequiredAction":310},"CVE-2023-41993","The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.","2023-09-21",8.8,0.24349,"Apple Multiple Products WebKit Code Execution Vulnerability","2023-09-25","Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"title":312,"metaDescription":313,"keywords":314,"structuredData":315},"Graalvm by Oracle - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Graalvm by Oracle covering 71 versions with 164 tracked vulnerabilities including 0 critical and 1 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Graalvm vulnerabilities, Graalvm security, Graalvm CVE, Oracle Graalvm, Graalvm threat intelligence, Oracle security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Graalvm KEV, Graalvm exploited vulnerabilities",{"@context":316,"@type":317,"name":318,"description":313,"url":319,"manufacturer":320,"applicationCategory":324,"softwareVersion":325,"mainEntity":326},"https:\u002F\u002Fschema.org","SoftwareApplication","Graalvm","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Foracle\u002Fgraalvm",{"@type":321,"name":322,"url":323},"Organization","Oracle","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Foracle","Security Software","71 versions tracked",{"@type":327,"name":328,"description":329,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Graalvm Security Vulnerabilities","Security vulnerabilities affecting Graalvm by Oracle",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":331,"apiVersion":332},"2026-10-17T12:11:09.544Z","3.0",[334],{"product":335,"cves":336},"graalvm_for_jdk",39,{"rows":338,"total":11,"capped":17,"failed":16},[339],{"cveId":302,"name":307,"severity":252,"cvss":305,"added":308,"epss":306,"published":340,"ranges":341,"checked":4,"hits":342,"covers":17},"2023-09-21T19:15:11.66",[75,152],[]]