CVE-2024-20952

HIGH

Published Jan 16, 2024 Modified Nov 3, 2025 CWE-284 CWE-416

Description

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1; Oracle GraalVM for JDK: 17.0.9, 21.0.1; Oracle GraalVM Enterprise Edition: 20.3.12, 21.3.8 and 22.3.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

Is your site exposed to CVE-2024-20952?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.4

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness Type (CWE)

CWE-284 CWE-284

CWE-416 Use After Free

Affected Products

Vendor	Product	Versions
oracle	openjdk	11 — 11.0.24
oracle	openjdk	17 — 17.0.10
oracle	openjdk	21 — 21.0.2
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	openjdk	All
oracle	graalvm	All
oracle	graalvm	All
oracle	graalvm	All
oracle	graalvm_for_jdk	All
oracle	graalvm_for_jdk	All
oracle	jdk	All
oracle	jdk	All
oracle	jdk	All
oracle	jdk	All
oracle	jdk	All
oracle	jre	All
oracle	jre	All
oracle	jre	All
oracle	jre	All
oracle	jre	All
netapp	cloud_insights_acquisition_unit	All
netapp	cloud_insights_storage_workload_security_agent	All
netapp	oncommand_insight	All
debian	debian_linux	All

References

Advisories & Patches

https://www.oracle.com/security-alerts/cpujan2024.html https://www.oracle.com/security-alerts/cpujan2024.html

Other References

https://lists.debian.org/debian-lts-announce/2024/01/msg00023.html https://security.netapp.com/advisory/ntap-20240201-0002/ https://lists.debian.org/debian-lts-announce/2024/01/msg00023.html https://security.netapp.com/advisory/ntap-20240201-0002/ https://security.netapp.com/advisory/ntap-20241108-0002/

Frequently Asked Questions

What is CVE-2024-20952? +

How severe is CVE-2024-20952? +

CVE-2024-20952 has a CVSS v3.1 score of 7.4 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-20952? +

CVE-2024-20952 affects products from debian, netapp, oracle, specifically: cloud_insights_acquisition_unit, cloud_insights_storage_workload_security_agent, debian_linux, graalvm, graalvm_for_jdk, jdk, jre, oncommand_insight, openjdk. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-20952? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-35402

mcp-neo4j-cypher is an MCP server for executing Cypher queries against Neo4j databases. In versions prior to 0.6.0, the read_only mode …

CVE-2026-40866

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in …

CVE-2026-40865

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in …

CVE-2026-40874

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administrator verification takes …

CVE-2026-54533

vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, malicious algorithms can potentially access other algorithms …

CVE-2026-48907

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately …

Quick Facts

CVSS Score: 7.4
Severity: HIGH
Published: Jan 16, 2024

Scan for this vulnerability

Check if your website or infrastructure is affected by CVE-2024-20952.

Website Scan Port Scan

Browse CVEs

Critical High CISA KEV ! Most likely exploited →