CVE-2009-2719: Sun Java SE

Medium severity, CVSS 5.0. EPSS: 2% chance of exploitation in the next 30 days.

The Java Web Start implementation in Sun Java SE 6 before Update 15 allows context-dependent attackers to cause a denial of service (NullPointerException) via a crafted .jnlp file, as demonstrated by the jnlp_file/appletDesc/index.html#misc test in the Technology Compatibility Kit (TCK) for the Java Network Launching Protocol (JNLP).

Affected products

• Sun Java SE: up to and including 6

Published 2009-08-10. Last modified 2026-06-16.