{"cve":"CVE-2018-2657","nvd":{"published":"2018-01-18T02:29:21.743","modified":"2026-06-17T01:56:03.033","status":"Modified","description":"Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u171 and 7u161; JRockit: R28.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, JRockit. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3},"cwes":[],"references":["http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.securityfocus.com/bid/102629","http://www.securitytracker.com/id/1040203","https://access.redhat.com/errata/RHSA-2018:0100","https://access.redhat.com/errata/RHSA-2018:0115"],"products":["hp:xp7_command_view","hp:xp_command_view","hp:xp_p9000_command_view","oracle:jdk","oracle:jre","oracle:jrockit","redhat:enterprise_linux_desktop","redhat:enterprise_linux_server","redhat:enterprise_linux_server_eus","redhat:enterprise_linux_workstation","redhat:satellite","schneider-electric:struxureware_data_center_expert"],"source":"nvd","synced_at":"2026-10-19T20:48:34.567387330+00:00"},"epss":{"cve":"CVE-2018-2657","score":0.07525,"percentile":0.94501,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}