CVE-2009-3881: Sun JRE

High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days.

Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, does not prevent the existence of children of a resurrected ClassLoader, which allows remote attackers to gain privileges via unspecified vectors, related to an "information leak vulnerability," aka Bug Id 6636650.

Affected products

• Sun JRE: up to and including 1.5.0; up to and including 1.6.0; version 1.5.0 only; version 1.6.0 only
• Sun Openjdk: any version

Published 2009-11-09. Last modified 2026-06-16.