# Oracle Critical Patch Update Advisory - April 2024 (CPU01)

This advisory addresses vulnerabilities in Oracle Java SE and Oracle GraalVM for JDK. It references CVE-2024-9000 and CVE-2024-9001 with additional remediation steps.

Affected Products and Versions | Patch Availability Document
--- | ---
Oracle Java SE, versions 8u401, 11.0.22 | Oracle Java SE
Oracle GraalVM for JDK, versions 21.3.8, 22.0.0 | Oracle GraalVM

CVE ID | Product | Component | Protocol | Remote Exploit without Auth.? | Base Score | Attack Vector | Attack Complex | Privs Req'd | User Interact | Scope | Confidentiality | Integrity | Availability | Supported Versions Affected | Notes
--- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | ---
CVE-2024-9000 | Oracle Java SE | Hotspot | Multiple | Yes | 9.8 | Network | Low | None | Required | Changed | High | High | High | Oracle Java SE: 8u401, 11.0.22 | Fixed in 8u401 Patch 123456
CVE-2024-9001 | Oracle Java SE, Oracle GraalVM for JDK | Libraries | Multiple | Yes | 7.5 | Network | High | None | Required | Changed | Medium | Medium | Medium | Oracle Java SE: 8u401, 11.0.22; Oracle GraalVM for JDK: 21.3.8, 22.0.0 | See Note A for mitigation

Note A: Apply interim update 22.0.0.1 for GraalVM.

- Patch download
- Support article