IRONSMITHINTEL
HIGHCVSS5.3
|CVE-2023-22081|Auth: none — accessible tls endpoint sufficient|Reboot: not required|Est. 30 minutes|Manual only

Oracle Java SE < 11.0.21 — DoS

An unauthenticated attacker can crash Java applications using TLS/SSL by sending a malformed TLS handshake. Apply the October 2023 Critical Patch Update — affects any server-side Java application accepting TLS connections.

Published Oct 17, 2023 · Updated May 10, 2026
Why patchRisk explained in plain English
Worst-case scenarioIf unpatched

An unauthenticated attacker who can reach a Java HTTPS endpoint can cause repeated denial of service by sending malformed TLS records. This is particularly impactful for high-availability services where crashing the JVM causes automatic failover cascades.

How the attack works

Java's built-in TLS implementation (JSSE) fails to properly handle certain malformed TLS handshake messages, causing the JVM to throw an uncaught exception and crash. Any Java application that accepts TLS connections using the built-in JSSE library is affected — including HTTPS servers, secure database connections, and message brokers.

Am I affected?Quick check

Probably yes if any of these apply:

●Java Application Teams
●DevOps Teams
●Server Administrators
●Running Java SE 11.0.20 and earlier, Java SE 17.0.8 and earlier, Java SE 21 and earlier, Java SE 8u381 and earlier

Affected OS versions

Windows Server 2016Windows Server 2019Windows Server 2022
Fixed inJava SE 8u391 / 11.0.21 / 17.0.9 / 21.0.1 (October 2023 CPU)
Real-world incidentsWhat we've seen

A financial services firm runs a Java-based trading API that accepts TLS connections. An attacker sends a flood of malformed TLS ClientHello messages, causing the Java process to crash repeatedly. The auto-restart loop causes cascading delays in trade execution. The October 2023 CPU update patches the JSSE parser.

How to patch

Manual remediation steps

⏱ 30 minutes

Check Java Version

java -version 2>&1

Apply October 2023 CPU

1
Download from https://www.oracle.com/java/technologies/javase-downloads.html
    1
    Java 8: 8u391, Java 11: 11.0.21, Java 17: 17.0.9, Java 21: 21.0.1
2
Install and restart Java application servers

Verify

java -version 2>&1
PowerShell automationComing soon

No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.

References

↗ CVE-2023-22081↗ NVD