CVE-2009-2690: Sun Java SE

Medium severity, CVSS 5.0. EPSS: 2.6% chance of exploitation in the next 30 days.

The encoder in Sun Java SE 6 before Update 15, and OpenJDK, grants read access to private variables with unspecified names, which allows context-dependent attackers to obtain sensitive information via an untrusted (1) applet or (2) application.

Affected products

• Sun Java SE: up to and including 6
• Sun Openjdk: any version

Published 2009-08-10. Last modified 2026-06-16.