The hook
Java runtime advisories are easy to overstate from source alone. CVE-2022-21340 affects specific Oracle Java SE and Oracle GraalVM Enterprise releases, but the useful repo signal is narrow: explicit runtime metadata that tells a team which container, toolchain, CI image, or packaged runtime needs patch review.
How it works
The repo check looks for Oracle Java SE and Oracle GraalVM Enterprise runtime/version evidence in deployment and build metadata. It intentionally avoids generic Java language-level settings, ordinary Maven compiler targets, OpenJDK/Temurin images, and GraalVM Community Edition evidence because those do not prove the affected Oracle product line.
The blast radius
If the affected Oracle runtime is the one deployed and it loads untrusted sandboxed code or exposes affected APIs under the advisory conditions, attackers may be able to cause partial denial of service. A repo match should trigger runtime inventory and patch validation before anyone treats it as confirmed production exposure.
// what fixvibe checks
What FixVibe checks
FixVibe repo scans look for high-confidence security patterns and dependency risk in source context. Reports identify the affected area and recommended fix. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
Ironclad defenses
Apply the Oracle January 2022 Critical Patch Update or a later supported Oracle update to the runtime that actually ships, rebuild affected images and artifacts, and verify the deployed runtime directly with java -version, GraalVM version metadata, package-manager output, or SBOM data before closing the advisory.