CVE-2022-21628

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE ...

5.3 MediumFix available

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

2.88%Up 2.0 points since Oct 19, 2022

What each source reports

CVE List Score used 5.3

Record: CVE-2022-21628
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

EUVDEUVD-2022-26852 5.3

Record: EUVD-2022-26852
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-34g7-gffm-5gm5 5.3

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE ...

Record: GHSA-34g7-gffm-5gm5
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

NVD 5.3

Record: CVE-2022-21628
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVALPINE-CVE-2022-21628 5.3

Record: ALPINE-CVE-2022-21628
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-03

OSV 5.3

Record: CVE-2022-21628
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

Show 45 moreShow less

OSVDEBIAN-CVE-2022-21628 5.3

Record: DEBIAN-CVE-2022-21628
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-03

OSVOESA-2022-2150 5.3

openjdk-latest security update

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2022-21626)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2022-21624)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2022-21619)

Record: OESA-2022-2150
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVOESA-2022-2151 5.3

openjdk-11 security update

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2022-21619)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 21.3.3 and 22.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via Kerberos to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2022-21618)

Record: OESA-2022-2151
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVOESA-2022-2152 5.3

openjdk-11 security update

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2022-21619)

Record: OESA-2022-2152
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVOESA-2022-2154 5.3

openjdk-11 security update

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1, 17.0.4.1, 19; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 and 22.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2022-21619)

Record: OESA-2022-2154
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHSA-2022:6999 5.5

Red Hat Security Advisory: java-17-openjdk security and bug fix update

Record: RHSA-2022:6999
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2022:7000 5.5

Red Hat Security Advisory: java-17-openjdk security and bug fix update

Record: RHSA-2022:7000
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2022:7001 5.3

Red Hat Security Advisory: java-17-openjdk security update

Record: RHSA-2022:7001
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHSA-2022:7002 5.3

Red Hat Security Advisory: java-1.8.0-openjdk security and bug fix update

Record: RHSA-2022:7002
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHSA-2022:7003 5.3

Red Hat Security Advisory: java-1.8.0-openjdk security update

Record: RHSA-2022:7003
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHSA-2022:7004 5.3

Red Hat Security Advisory: java-1.8.0-openjdk security update

Record: RHSA-2022:7004
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHSA-2022:7005 5.3

Red Hat Security Advisory: java-1.8.0-openjdk security update

Record: RHSA-2022:7005
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHSA-2022:7006 5.3

Red Hat Security Advisory: java-1.8.0-openjdk security update

Record: RHSA-2022:7006
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHSA-2022:7007 5.3

Red Hat Security Advisory: java-1.8.0-openjdk security update

Record: RHSA-2022:7007
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHSA-2022:7008 5.3

Red Hat Security Advisory: java-11-openjdk security and bug fix update

Record: RHSA-2022:7008
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHSA-2022:7009 5.3

Red Hat Security Advisory: java-11-openjdk security update

Record: RHSA-2022:7009
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHSA-2022:7010 5.3

Red Hat Security Advisory: java-11-openjdk security update

Record: RHSA-2022:7010
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHSA-2022:7011 5.3

Red Hat Security Advisory: java-11-openjdk security update

Record: RHSA-2022:7011
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHSA-2022:7012 5.5

Red Hat Security Advisory: java-11-openjdk security and bug fix update

Record: RHSA-2022:7012
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2022:7013 5.5

Red Hat Security Advisory: java-11-openjdk security and bug fix update

Record: RHSA-2022:7013
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2022:8880 5.3

Red Hat Security Advisory: java-1.8.0-ibm security update

Record: RHSA-2022:8880
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRHSA-2023:0128 5.3

Red Hat Security Advisory: java-1.8.0-ibm security update

Record: RHSA-2023:0128
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRLSA-2022:6999 5.3

Moderate: java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618)
OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)
OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)
OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)
OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)
OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

Prepare for the next quarterly OpenJDK upstream release (2022-10, 17.0.5) [Rocky Linux-9] (BZ#2132934)

Record: RLSA-2022:6999
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVRLSA-2022:7000 5.3

Moderate: java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618)
OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)
OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)
OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)
OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)
OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

Prepare for the next quarterly OpenJDK upstream release (2022-10, 17.0.5) [Rocky Linux-8] (BZ#2132503)

Record: RLSA-2022:7000
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVRLSA-2022:7006 5.3

Moderate: java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)
OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)
OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)
OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2022:7006
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRLSA-2022:7007 5.3

Moderate: java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)
OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)
OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)
OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2022:7007
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVRLSA-2022:7012 5.3

Moderate: java-11-openjdk security and bug fix update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.

Security Fix(es):

OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618)
OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)
OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)
OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)
OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)
OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

Prepare for the next quarterly OpenJDK upstream release (2022-10, 11.0.17) [Rocky Linux-8] (BZ#2131863)

Record: RLSA-2022:7012
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVRLSA-2022:7013 5.3

Moderate: java-11-openjdk security and bug fix update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.

Security Fix(es):

OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618)
OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)
OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)
OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)
OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)
OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

Prepare for the next quarterly OpenJDK upstream release (2022-10, 11.0.17) [Rocky Linux-9] (BZ#2131865)

Record: RLSA-2022:7013
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-21628 5.3

Record: UBUNTU-CVE-2022-21628
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVALSA-2022:6999 No score

Moderate: java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618)
OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)
OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)
OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)
OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)
OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

Prepare for the next quarterly OpenJDK upstream release (2022-10, 17.0.5) [almalinux-9] (BZ#2132934)

Record: ALSA-2022:6999
Updated: 2026-11-02

OSVALSA-2022:7000 No score

Moderate: java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618)
OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)
OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)
OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)
OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)
OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

Prepare for the next quarterly OpenJDK upstream release (2022-10, 17.0.5) [almalinux-8] (BZ#2132503)

Record: ALSA-2022:7000
Updated: 2026-11-02

OSVALSA-2022:7006 No score

Moderate: java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)
OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)
OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)
OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2022:7006
Updated: 2026-11-02

OSVALSA-2022:7007 No score

Moderate: java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)
OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)
OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)
OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2022:7007
Updated: 2026-11-02

OSVALSA-2022:7012 No score

Moderate: java-11-openjdk security and bug fix update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.

Security Fix(es):

OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618)
OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)
OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)
OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)
OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)
OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

Prepare for the next quarterly OpenJDK upstream release (2022-10, 11.0.17) [almalinux-8] (BZ#2131863)

Record: ALSA-2022:7012
Updated: 2026-11-02

OSVALSA-2022:7013 No score

Moderate: java-11-openjdk security and bug fix update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.

Security Fix(es):

OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618)
OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626)
OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628)
OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619)
OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624)
OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

Prepare for the next quarterly OpenJDK upstream release (2022-10, 11.0.17) [almalinux-9] (BZ#2131865)

Record: ALSA-2022:7013
Updated: 2026-11-02

OSVBIT-java-2022-21628 No score

Record: BIT-java-2022-21628
Updated: 2026-11-02

OSVBIT-java-min-2022-21628 No score

Record: BIT-java-min-2022-21628
Updated: 2026-11-02

OSVBIT-jre-2022-21628 No score

Record: BIT-jre-2022-21628
Updated: 2026-11-02

OSVCLSA-2022-1667494847 No score

java-1.8.0-openjdk: Fix of 4 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u352-b08. That fixes following CVEs:
CVE-2022-21619: Improper handling of long NTLM client hostnames
CVE-2022-21624: Insufficient randomization of JNDI DNS port numbers
CVE-2022-21626: Excessive memory allocation in X.509 certificate parsing
CVE-2022-21628: HttpServer no connection count limit
Update tzdata requirement to 2022c to match JDK-8292579
Adapt rh1860986-disable_tlsv1.3_in_fips_mode.patch to new sources
Improve security properties test to check both enabled and disabled behaviour
Add test to ensure timezones can be translated

Record: CLSA-2022-1667494847
Updated: 2026-11-02

OSVCLSA-2022-1667495676 No score

java-1.8.0-openjdk: Fix of 4 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u352-b08. That fixes following CVEs:
CVE-2022-21619: Improper handling of long NTLM client hostnames
CVE-2022-21624: Insufficient randomization of JNDI DNS port numbers
CVE-2022-21626: Excessive memory allocation in X.509 certificate parsing
CVE-2022-21628: HttpServer no connection count limit
Update tzdata requirement to 2022c to match JDK-8292579
Adapt rh1860986-disable_tlsv1.3_in_fips_mode.patch to new sources
Improve security properties test to check both enabled and disabled behaviour
Add test to ensure timezones can be translated

Record: CLSA-2022-1667495676
Updated: 2026-11-02

OSVCLSA-2022-1669309108 No score

Fix CVE(s): CVE-2022-21628, CVE-2022-21626, CVE-2022-21624, CVE-2022-21619

Backport upstream releases 8u352 to 16.04 LTS
Security fixes in 8u352:
- JDK-8282252: Improve BigInteger/Decimal validation
- JDK-8285662: Better permission resolution
- JDK-8286511: Improve macro allocation
- JDK-8286519: Better memory handling
- JDK-8286526, CVE-2022-21619: Improve NTLM support
- JDK-8286533, CVE-2022-21626: Key X509 usages
- JDK-8286910, CVE-2022-21624: Improve JNDI lookups
- JDK-8286918, CVE-2022-21628: Better HttpServer service
- JDK-8288508: Enhance ECDSA usage
Drop applied patch pr88.diff

Record: CLSA-2022-1669309108
Updated: 2026-11-02

OSVMGASA-2022-0435 No score

Updated java packages fix security vulnerability

Class compilation issue. (CVE-2022-21540) Improper restriction of MethodHandle.invokeBasic(). (CVE-2022-21541) Integer truncation issue in Xalan-J. (CVE-2022-34169) Improper MultiByte conversion can lead to buffer overflow. (CVE-2022-21618) Improper handling of long NTLM client hostnames. (CVE-2022-21619) Insufficient randomization of JNDI DNS port numbers. (CVE-2022-21624) Excessive memory allocation in X.509 certificate parsing. (CVE-2022-21626) HttpServer no connection count limit. (CVE-2022-21628) Missing SNI caching in HTTP/2. (CVE-2022-39399)

Record: MGASA-2022-0435
Updated: 2026-11-02

OSVopenSUSE-SU-2024:12431-1 No score

java-11-openjdk-11.0.17.0-1.1 on GA media

These are all security issues fixed in the java-11-openjdk-11.0.17.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:12431-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:12432-1 No score

java-17-openjdk-17.0.5.0-1.1 on GA media

These are all security issues fixed in the java-17-openjdk-17.0.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:12432-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:12441-1 No score

java-13-openjdk-13.0.13.0-1.1 on GA media

These are all security issues fixed in the java-13-openjdk-13.0.13.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:12441-1
Updated: 2026-11-02

Affected products

Show 4 moreShow less

Affected packages

Affected packages
Package	Affected	Fixed
`openjdk11` Alpine:v3.15	before 11.0.17_p8-r0	11.0.17_p8-r0
`openjdk11` Alpine:v3.16	before 11.0.17_p8-r0	11.0.17_p8-r0
`openjdk11` Alpine:v3.17	before 11.0.17_p8-r0	11.0.17_p8-r0
`openjdk11` Alpine:v3.18	before 11.0.17_p8-r0	11.0.17_p8-r0
`openjdk11` Alpine:v3.19	before 11.0.17_p8-r0	11.0.17_p8-r0
`openjdk11` Alpine:v3.20	before 11.0.17_p8-r0	11.0.17_p8-r0
`openjdk11` Alpine:v3.21	before 11.0.17_p8-r0	11.0.17_p8-r0
`openjdk11` Alpine:v3.22	before 11.0.17_p8-r0	11.0.17_p8-r0
`openjdk11` Alpine:v3.23	before 11.0.17_p8-r0	11.0.17_p8-r0
`openjdk11` Alpine:v3.24	before 11.0.17_p8-r0	11.0.17_p8-r0

Show 290 moreShow less

Affected packages
Package	Affected	Fixed
`openjdk17` Alpine:v3.15	before 17.0.5_p8-r0	17.0.5_p8-r0
`openjdk17` Alpine:v3.16	before 17.0.5_p8-r0	17.0.5_p8-r0
`openjdk17` Alpine:v3.17	before 17.0.5_p8-r0	17.0.5_p8-r0
`openjdk17` Alpine:v3.18	before 17.0.5_p8-r0	17.0.5_p8-r0
`openjdk17` Alpine:v3.19	before 17.0.5_p8-r0	17.0.5_p8-r0
`openjdk17` Alpine:v3.20	before 17.0.5_p8-r0	17.0.5_p8-r0
`openjdk17` Alpine:v3.21	before 17.0.5_p8-r0	17.0.5_p8-r0
`openjdk17` Alpine:v3.22	before 17.0.5_p8-r0	17.0.5_p8-r0
`openjdk17` Alpine:v3.23	before 17.0.5_p8-r0	17.0.5_p8-r0
`openjdk17` Alpine:v3.24	before 17.0.5_p8-r0	17.0.5_p8-r0
`openjdk8` Alpine:v3.15	before 8.362.09-r0	8.362.09-r0
`openjdk8` Alpine:v3.16	before 8.362.09-r0	8.362.09-r0
`openjdk8` Alpine:v3.17	before 8.362.09-r0	8.362.09-r0
`openjdk8` Alpine:v3.18	before 8.362.09-r0	8.362.09-r0
`openjdk8` Alpine:v3.19	before 8.362.09-r0	8.362.09-r0
`openjdk8` Alpine:v3.20	before 8.362.09-r0	8.362.09-r0
`openjdk8` Alpine:v3.21	before 8.362.09-r0	8.362.09-r0
`openjdk8` Alpine:v3.22	before 8.362.09-r0	8.362.09-r0
`openjdk8` Alpine:v3.23	before 8.362.09-r0	8.362.09-r0
`openjdk8` Alpine:v3.24	before 8.362.09-r0	8.362.09-r0
`java-17-openjdk` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-demo` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-demo-fastdebug` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-demo-slowdebug` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-devel` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-devel-fastdebug` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-devel-slowdebug` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-fastdebug` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-headless` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-headless-fastdebug` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-headless-slowdebug` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-javadoc` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-javadoc-zip` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-jmods` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-jmods-fastdebug` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-jmods-slowdebug` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-slowdebug` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-src` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-src-fastdebug` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-src-slowdebug` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-static-libs` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-static-libs-fastdebug` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-static-libs-slowdebug` AlmaLinux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-demo` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-demo-fastdebug` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-demo-slowdebug` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-devel` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-devel-fastdebug` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-devel-slowdebug` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-fastdebug` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-headless` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-headless-fastdebug` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-headless-slowdebug` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-javadoc` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-javadoc-zip` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-jmods` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-jmods-fastdebug` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-jmods-slowdebug` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-slowdebug` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-src` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-src-fastdebug` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-src-slowdebug` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-static-libs` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-static-libs-fastdebug` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-static-libs-slowdebug` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-1.8.0-openjdk` AlmaLinux:8 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-2.el8_6	1:1.8.0.352.b08-2.el8_6
`java-1.8.0-openjdk-accessibility` AlmaLinux:8 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-2.el8_6	1:1.8.0.352.b08-2.el8_6
`java-1.8.0-openjdk-accessibility-fastdebug` AlmaLinux:8 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-2.el8_6	1:1.8.0.352.b08-2.el8_6
`java-1.8.0-openjdk-accessibility-slowdebug` AlmaLinux:8 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-2.el8_6	1:1.8.0.352.b08-2.el8_6
`java-1.8.0-openjdk-demo` AlmaLinux:8 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-2.el8_6	1:1.8.0.352.b08-2.el8_6
`java` Bitnami	before 1.8.0, 1.9.0 up to 8.0.351, 9.0.0 up to 11.0.17, 12.0.0 up to 17.0.5, 18.0.0 up to 19.0.1	1.8.08.0.35111.0.1717.0.519.0.1
`java-min` Bitnami	before 1.8.0, 1.9.0 up to 8.0.351, 9.0.0 up to 11.0.17, 12.0.0 up to 17.0.5, 18.0.0 up to 19.0.1	1.8.08.0.35111.0.1717.0.519.0.1
`jre` Bitnami	before 1.8.0, 1.9.0 up to 8.0.351, 9.0.0 up to 11.0.17, 12.0.0 up to 17.0.5, 18.0.0 up to 19.0.1	1.8.08.0.35111.0.1717.0.519.0.1
`java-1.8.0-openjdk` TuxCare:CentOS:8.4 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-accessibility` TuxCare:CentOS:8.4 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-accessibility-fastdebug` TuxCare:CentOS:8.4 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-accessibility-slowdebug` TuxCare:CentOS:8.4 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-demo` TuxCare:CentOS:8.4 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-demo-fastdebug` TuxCare:CentOS:8.4 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-demo-slowdebug` TuxCare:CentOS:8.4 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-devel` TuxCare:CentOS:8.4 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-devel-fastdebug` TuxCare:CentOS:8.4 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-devel-slowdebug` TuxCare:CentOS:8.4 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-fastdebug` TuxCare:CentOS:8.4 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-headless` TuxCare:CentOS:8.4 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-headless-fastdebug` TuxCare:CentOS:8.4 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-headless-slowdebug` TuxCare:CentOS:8.4 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-javadoc` TuxCare:CentOS:8.4 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-javadoc-zip` TuxCare:CentOS:8.4 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-slowdebug` TuxCare:CentOS:8.4 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-src` TuxCare:CentOS:8.4 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-src-fastdebug` TuxCare:CentOS:8.4 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-src-slowdebug` TuxCare:CentOS:8.4 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk` TuxCare:CentOS:8.5 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-accessibility` TuxCare:CentOS:8.5 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-accessibility-fastdebug` TuxCare:CentOS:8.5 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-accessibility-slowdebug` TuxCare:CentOS:8.5 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-demo` TuxCare:CentOS:8.5 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-demo-fastdebug` TuxCare:CentOS:8.5 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-demo-slowdebug` TuxCare:CentOS:8.5 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-devel` TuxCare:CentOS:8.5 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-devel-fastdebug` TuxCare:CentOS:8.5 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-devel-slowdebug` TuxCare:CentOS:8.5 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-fastdebug` TuxCare:CentOS:8.5 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-headless` TuxCare:CentOS:8.5 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-headless-fastdebug` TuxCare:CentOS:8.5 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-headless-slowdebug` TuxCare:CentOS:8.5 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-javadoc` TuxCare:CentOS:8.5 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-javadoc-zip` TuxCare:CentOS:8.5 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-slowdebug` TuxCare:CentOS:8.5 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-src` TuxCare:CentOS:8.5 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-src-fastdebug` TuxCare:CentOS:8.5 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`java-1.8.0-openjdk-src-slowdebug` TuxCare:CentOS:8.5 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-1.el8.tuxcare.els1	1:1.8.0.352.b08-1.el8.tuxcare.els1
`openjdk-8-demo` TuxCare:Ubuntu:16.04 From an advisory covering 4 CVEs	before 8u352-ga-0ubuntu1~16.04+tuxcare.els1	8u352-ga-0ubuntu1~16.04+tuxcare.els1
`openjdk-8-doc` TuxCare:Ubuntu:16.04 From an advisory covering 4 CVEs	before 8u352-ga-0ubuntu1~16.04+tuxcare.els1	8u352-ga-0ubuntu1~16.04+tuxcare.els1
`openjdk-8-jdk` TuxCare:Ubuntu:16.04 From an advisory covering 4 CVEs	before 8u352-ga-0ubuntu1~16.04+tuxcare.els1	8u352-ga-0ubuntu1~16.04+tuxcare.els1
`openjdk-8-jdk-headless` TuxCare:Ubuntu:16.04 From an advisory covering 4 CVEs	before 8u352-ga-0ubuntu1~16.04+tuxcare.els1	8u352-ga-0ubuntu1~16.04+tuxcare.els1
`openjdk-8-jre` TuxCare:Ubuntu:16.04 From an advisory covering 4 CVEs	before 8u352-ga-0ubuntu1~16.04+tuxcare.els1	8u352-ga-0ubuntu1~16.04+tuxcare.els1
`openjdk-8-jre-headless` TuxCare:Ubuntu:16.04 From an advisory covering 4 CVEs	before 8u352-ga-0ubuntu1~16.04+tuxcare.els1	8u352-ga-0ubuntu1~16.04+tuxcare.els1
`openjdk-8-jre-jamvm` TuxCare:Ubuntu:16.04 From an advisory covering 4 CVEs	before 8u352-ga-0ubuntu1~16.04+tuxcare.els1	8u352-ga-0ubuntu1~16.04+tuxcare.els1
`openjdk-8-jre-zero` TuxCare:Ubuntu:16.04 From an advisory covering 4 CVEs	before 8u352-ga-0ubuntu1~16.04+tuxcare.els1	8u352-ga-0ubuntu1~16.04+tuxcare.els1
`openjdk-8-source` TuxCare:Ubuntu:16.04 From an advisory covering 4 CVEs	before 8u352-ga-0ubuntu1~16.04+tuxcare.els1	8u352-ga-0ubuntu1~16.04+tuxcare.els1
`openjdk-17` Debian:12	before 17.0.5+8-1	17.0.5+8-1
`openjdk-11` Debian:10 From an advisory covering 7 CVEs	before 11.0.18+10-1~deb10u1, plus listed versions 11.0.10+8-111.0.10+9-111.0.11+3-111.0.11+3-211.0.11+3-3 Show 45 moreShow less 11.0.11+4-111.0.11+7-111.0.11+8-111.0.11+9-111.0.11+9-1~deb10u111.0.12+4-111.0.12+6-111.0.12+7-111.0.12+7-211.0.12+7-2~deb10u111.0.13+8-111.0.13+8-1~deb10u111.0.13+8-1~deb11u111.0.14+9-111.0.14+9-1~deb10u111.0.14+9-1~deb11u111.0.14.1+1-111.0.15+10-111.0.15+10-1~deb10u111.0.15+10-1~deb11u111.0.16+8-111.0.16+8-1~deb10u111.0.16+8-1~deb11u111.0.17+8-111.0.17+8-211.0.3+7-511.0.4+1-111.0.4+10-111.0.4+11-111.0.4+11-1~bpo9+111.0.4+11-1~deb10u111.0.4+2-111.0.4+4+really11.0.3+7-111.0.4+4+really11.0.3+7-211.0.4+4-111.0.4+6-111.0.4+8-111.0.4+9-111.0.5+10-111.0.5+10-1~bpo9+111.0.5+10-1~deb10u111.0.5+10-211.0.5+6-111.0.5+6-211.0.5+9-1	11.0.18+10-1~deb10u1
`openjdk-11` Debian:11 From an advisory covering 7 CVEs	before 11.0.18+10-1~deb11u1, plus listed versions 11.0.12+7-211.0.13+8-111.0.13+8-1~deb10u111.0.13+8-1~deb11u111.0.14+9-1 Show 12 moreShow less 11.0.14+9-1~deb10u111.0.14+9-1~deb11u111.0.14.1+1-111.0.15+10-111.0.15+10-1~deb10u111.0.15+10-1~deb11u111.0.16+8-111.0.16+8-1~deb10u111.0.16+8-1~deb11u111.0.17+8-111.0.17+8-211.0.18+10-1~deb10u1	11.0.18+10-1~deb11u1
`openjdk-17` Debian:11 From an advisory covering 7 CVEs	before 17.0.6+10-1~deb11u1, plus listed versions 17+35-117.0.1+12-117.0.1+12-1+deb11u117.0.1+12-1+deb11u217.0.2+8-1 Show 14 moreShow less 17.0.2+8-1~deb11u117.0.3+7-117.0.3+7-1~deb11u117.0.4+8-117.0.4+8-1~deb11u117.0.5+8-117.0.5+8-217~19-117~24-117~27-117~29-117~31ea-117~33ea-117~35ea-1	17.0.6+10-1~deb11u1
`java-1.8.0-openjdk` Mageia:8 From an advisory covering 9 CVEs	before 1.8.0.352.b08-1.1.mga8	1.8.0.352.b08-1.1.mga8
`java-11-openjdk` Mageia:8 From an advisory covering 9 CVEs	before 11.0.17.0.8-1.1.mga8	11.0.17.0.8-1.1.mga8
`timezone` Mageia:8 From an advisory covering 9 CVEs	before 2022e-1.mga8	2022e-1.mga8
`openjdk-latest` openEuler:20.03-LTS-SP1 From an advisory covering 6 CVEs	before java-latest-openjdk-19.0.0.36-1.rolling.oe1	java-latest-openjdk-19.0.0.36-1.rolling.oe1
`openjdk-latest` openEuler:20.03-LTS-SP3 From an advisory covering 6 CVEs	before java-latest-openjdk-19.0.0.36-1.rolling.oe1	java-latest-openjdk-19.0.0.36-1.rolling.oe1
`openjdk-latest` openEuler:22.03-LTS From an advisory covering 6 CVEs	before java-latest-openjdk-19.0.0.36-1.rolling.oe2203	java-latest-openjdk-19.0.0.36-1.rolling.oe2203
`openjdk-11` openEuler:22.03-LTS From an advisory covering 6 CVEs	before java-11-openjdk-11.0.17.8-0.oe2203	java-11-openjdk-11.0.17.8-0.oe2203
`openjdk-11` openEuler:20.03-LTS-SP1 From an advisory covering 7 CVEs	before java-11-openjdk-11.0.17.8-1.oe1	java-11-openjdk-11.0.17.8-1.oe1
`openjdk-11` openEuler:20.03-LTS-SP3 From an advisory covering 6 CVEs	before java-11-openjdk-11.0.17.8-1.oe1	java-11-openjdk-11.0.17.8-1.oe1
`java-17-openjdk` Red Hat:enterprise_linux:9::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-debugsource` Red Hat:enterprise_linux:9::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-demo` Red Hat:enterprise_linux:9::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-devel` Red Hat:enterprise_linux:9::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-devel-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-headless` Red Hat:enterprise_linux:9::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-headless-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-javadoc` Red Hat:enterprise_linux:9::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-javadoc-zip` Red Hat:enterprise_linux:9::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-jmods` Red Hat:enterprise_linux:9::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-src` Red Hat:enterprise_linux:9::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-static-libs` Red Hat:enterprise_linux:9::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-debugsource` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-demo-fastdebug` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-demo-slowdebug` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-devel-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-devel-fastdebug` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-devel-fastdebug-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-devel-slowdebug` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-devel-slowdebug-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-fastdebug` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-fastdebug-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-headless-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-headless-fastdebug` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-headless-fastdebug-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-headless-slowdebug` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-headless-slowdebug-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-jmods-fastdebug` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-jmods-slowdebug` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-slowdebug` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-slowdebug-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-src-fastdebug` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-src-slowdebug` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-static-libs-fastdebug` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk-static-libs-slowdebug` Red Hat:enterprise_linux:9::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk` Red Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-demo` Red Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-devel` Red Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-devel-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-headless` Red Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-headless-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-javadoc` Red Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-javadoc-zip` Red Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-jmods` Red Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-src` Red Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-static-libs` Red Hat:enterprise_linux:8::appstream From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 7 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-17-openjdk` Rocky Linux:9 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el9_0	1:17.0.5.0.8-2.el9_0
`java-17-openjdk` Rocky Linux:8 From an advisory covering 6 CVEs	before 1:17.0.5.0.8-2.el8_6	1:17.0.5.0.8-2.el8_6
`java-1.8.0-openjdk` Rocky Linux:8 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-2.el8_7	1:1.8.0.352.b08-2.el8_7
`java-1.8.0-openjdk` Rocky Linux:8 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-2.el8_6	1:1.8.0.352.b08-2.el8_6
`java-1.8.0-openjdk` Rocky Linux:9 From an advisory covering 4 CVEs	before 1:1.8.0.352.b08-2.el9_0	1:1.8.0.352.b08-2.el9_0
`java-11-openjdk` Rocky Linux:8 From an advisory covering 6 CVEs	before 1:11.0.17.0.8-2.el8_6	1:11.0.17.0.8-2.el8_6
`java-11-openjdk` Rocky Linux:9 From an advisory covering 6 CVEs	before 1:11.0.17.0.8-2.el9_0	1:11.0.17.0.8-2.el9_0
`java-11-openjdk` SUSE:Linux Enterprise Module for Basesystem 15 SP3 From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Linux Enterprise Module for Basesystem 15 SP4 From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Linux Enterprise Module for Package Hub 15 SP3 From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Linux Enterprise Module for Package Hub 15 SP4 From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Linux Enterprise Server 15-LTSS From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Linux Enterprise Server 15 SP1-BCL From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Linux Enterprise Server 15 SP2-BCL From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Manager Proxy 4.1 From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Manager Retail Branch Server 4.1 From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Manager Server 4.1 From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Enterprise Storage 6 From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` SUSE:Enterprise Storage 7 From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` openSUSE:Leap 15.3 From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-11-openjdk` openSUSE:Leap 15.4 From an advisory covering 6 CVEs	before 11.0.17.0-150000.3.86.2	11.0.17.0-150000.3.86.2
`java-17-openjdk` SUSE:Linux Enterprise Module for Basesystem 15 SP4 From an advisory covering 5 CVEs	before 17.0.5.0-150400.3.6.1	17.0.5.0-150400.3.6.1
`java-17-openjdk` openSUSE:Leap 15.4 From an advisory covering 5 CVEs	before 17.0.5.0-150400.3.6.1	17.0.5.0-150400.3.6.1
`java-11-openjdk` SUSE:Linux Enterprise Server 12 SP5 From an advisory covering 6 CVEs	before 11.0.17.0-3.49.2	11.0.17.0-3.49.2
`java-11-openjdk` SUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 6 CVEs	before 11.0.17.0-3.49.2	11.0.17.0-3.49.2
`java-1_8_0-ibm` SUSE:Linux Enterprise Module for Legacy 15 SP3 From an advisory covering 10 CVEs	before 1.8.0_sr7.20-150000.3.65.1	1.8.0_sr7.20-150000.3.65.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Module for Legacy 15 SP4 From an advisory covering 10 CVEs	before 1.8.0_sr7.20-150000.3.65.1	1.8.0_sr7.20-150000.3.65.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 15-LTSS From an advisory covering 10 CVEs	before 1.8.0_sr7.20-150000.3.65.1	1.8.0_sr7.20-150000.3.65.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 15 SP1-BCL From an advisory covering 10 CVEs	before 1.8.0_sr7.20-150000.3.65.1	1.8.0_sr7.20-150000.3.65.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 10 CVEs	before 1.8.0_sr7.20-150000.3.65.1	1.8.0_sr7.20-150000.3.65.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 10 CVEs	before 1.8.0_sr7.20-150000.3.65.1	1.8.0_sr7.20-150000.3.65.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 10 CVEs	before 1.8.0_sr7.20-150000.3.65.1	1.8.0_sr7.20-150000.3.65.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 10 CVEs	before 1.8.0_sr7.20-150000.3.65.1	1.8.0_sr7.20-150000.3.65.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 10 CVEs	before 1.8.0_sr7.20-150000.3.65.1	1.8.0_sr7.20-150000.3.65.1
`java-1_8_0-ibm` SUSE:Manager Proxy 4.1 From an advisory covering 10 CVEs	before 1.8.0_sr7.20-150000.3.65.1	1.8.0_sr7.20-150000.3.65.1
`java-1_8_0-ibm` SUSE:Manager Retail Branch Server 4.1 From an advisory covering 10 CVEs	before 1.8.0_sr7.20-150000.3.65.1	1.8.0_sr7.20-150000.3.65.1
`java-1_8_0-ibm` SUSE:Manager Server 4.1 From an advisory covering 10 CVEs	before 1.8.0_sr7.20-150000.3.65.1	1.8.0_sr7.20-150000.3.65.1
`java-1_8_0-ibm` SUSE:Enterprise Storage 6 From an advisory covering 10 CVEs	before 1.8.0_sr7.20-150000.3.65.1	1.8.0_sr7.20-150000.3.65.1
`java-1_8_0-ibm` SUSE:Enterprise Storage 7 From an advisory covering 10 CVEs	before 1.8.0_sr7.20-150000.3.65.1	1.8.0_sr7.20-150000.3.65.1
`java-1_8_0-ibm` openSUSE:Leap 15.3 From an advisory covering 10 CVEs	before 1.8.0_sr7.20-150000.3.65.1	1.8.0_sr7.20-150000.3.65.1
`java-1_8_0-ibm` openSUSE:Leap 15.4 From an advisory covering 10 CVEs	before 1.8.0_sr7.20-150000.3.65.1	1.8.0_sr7.20-150000.3.65.1
`java-1_8_0-openj9` openSUSE:Leap 15.3 From an advisory covering 5 CVEs	before 1.8.0.352-150200.3.27.1	1.8.0.352-150200.3.27.1
`java-1_8_0-openj9` openSUSE:Leap 15.4 From an advisory covering 5 CVEs	before 1.8.0.352-150200.3.27.1	1.8.0.352-150200.3.27.1
`java-1_8_0-ibm` SUSE:OpenStack Cloud 9 From an advisory covering 6 CVEs	before 1.8.0_sr7.20-30.99.1	1.8.0_sr7.20-30.99.1
`java-1_8_0-ibm` SUSE:OpenStack Cloud Crowbar 9 From an advisory covering 6 CVEs	before 1.8.0_sr7.20-30.99.1	1.8.0_sr7.20-30.99.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 6 CVEs	before 1.8.0_sr7.20-30.99.1	1.8.0_sr7.20-30.99.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 6 CVEs	before 1.8.0_sr7.20-30.99.1	1.8.0_sr7.20-30.99.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 6 CVEs	before 1.8.0_sr7.20-30.99.1	1.8.0_sr7.20-30.99.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 6 CVEs	before 1.8.0_sr7.20-30.99.1	1.8.0_sr7.20-30.99.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 6 CVEs	before 1.8.0_sr7.20-30.99.1	1.8.0_sr7.20-30.99.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 12 SP5 From an advisory covering 6 CVEs	before 1.8.0_sr7.20-30.99.1	1.8.0_sr7.20-30.99.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 6 CVEs	before 1.8.0_sr7.20-30.99.1	1.8.0_sr7.20-30.99.1
`java-1_8_0-openjdk` SUSE:OpenStack Cloud 9 From an advisory covering 4 CVEs	before 1.8.0.352-27.81.1	1.8.0.352-27.81.1
`java-1_8_0-openjdk` SUSE:OpenStack Cloud Crowbar 9 From an advisory covering 4 CVEs	before 1.8.0.352-27.81.1	1.8.0.352-27.81.1
`java-1_8_0-openjdk` openSUSE:Leap 15.3 From an advisory covering 4 CVEs	before 1.8.0.352-150000.3.73.1	1.8.0.352-150000.3.73.1
`java-1_8_0-openjdk` openSUSE:Leap 15.4 From an advisory covering 4 CVEs	before 1.8.0.352-150000.3.73.1	1.8.0.352-150000.3.73.1
`openjdk-8` Ubuntu:Pro:16.04:LTS	before 8u352-ga-1~16.04, plus listed versions 8u66-b01-58u72-b05-1ubuntu18u72-b05-58u72-b05-68u72-b15-1 Show 33 moreShow less 8u72-b15-2ubuntu18u72-b15-2ubuntu38u72-b15-3ubuntu18u77-b03-1ubuntu28u77-b03-3ubuntu18u77-b03-3ubuntu28u77-b03-3ubuntu38u91-b14-0ubuntu4~16.04.18u91-b14-3ubuntu1~16.04.18u111-b14-2ubuntu0.16.04.28u121-b13-0ubuntu1.16.04.28u131-b11-0ubuntu1.16.04.28u131-b11-2ubuntu1.16.04.28u131-b11-2ubuntu1.16.04.38u151-b12-0ubuntu0.16.04.28u162-b12-0ubuntu0.16.04.28u171-b11-0ubuntu0.16.04.18u181-b13-0ubuntu0.16.04.18u181-b13-1ubuntu0.16.04.18u191-b12-0ubuntu0.16.04.18u191-b12-2ubuntu0.16.04.18u212-b03-0ubuntu1.16.04.18u222-b10-1ubuntu1~16.04.18u232-b09-0ubuntu1~16.04.18u242-b08-0ubuntu3~16.048u252-b09-1~16.048u265-b01-0ubuntu2~16.048u272-b10-0ubuntu1~16.048u275-b01-0ubuntu1~16.048u282-b08-0ubuntu1~16.048u292-b10-0ubuntu1~16.04.18u312-b07-0ubuntu1~16.048u342-b07-0ubuntu1~16.04	8u352-ga-1~16.04
`openjdk-9` Ubuntu:16.04:LTS	All versions, plus listed versions 9~b88-19~b101-2ubuntu29~b102-19~b113-0ubuntu19~b114-0ubuntu1	None known
`openjdk-17` Ubuntu:18.04:LTS	before 17.0.5+8-2ubuntu1~18.04, plus listed versions 17+35-1~18.0417.0.1+12-1~18.0417.0.2+8-1~18.0417.0.3+7-0ubuntu0.18.04.117.0.4+8-1~18.04	17.0.5+8-2ubuntu1~18.04
`openjdk-8` Ubuntu:18.04:LTS	before 8u352-ga-1~18.04, plus listed versions 8u144-b01-28u151-b12-18u162-b12-18u171-b11-0ubuntu0.18.04.18u181-b13-0ubuntu0.18.04.1 Show 15 moreShow less 8u181-b13-1ubuntu0.18.04.18u191-b12-0ubuntu0.18.04.18u191-b12-2ubuntu0.18.04.18u212-b03-0ubuntu1.18.04.18u222-b10-1ubuntu1~18.04.18u232-b09-0ubuntu1~18.04.18u242-b08-0ubuntu3~18.048u252-b09-1~18.048u265-b01-0ubuntu2~18.048u272-b10-0ubuntu1~18.048u275-b01-0ubuntu1~18.048u282-b08-0ubuntu1~18.048u292-b10-0ubuntu1~18.048u312-b07-0ubuntu1~18.048u342-b07-0ubuntu1~18.04	8u352-ga-1~18.04
`openjdk-lts` Ubuntu:18.04:LTS	before 11.0.17+8-1ubuntu2~18.04, plus listed versions 9.0.4+12-2ubuntu49.0.4+12-4ubuntu110~46-4ubuntu110~46-5ubuntu110.0.1+10-1ubuntu2 Show 21 moreShow less 10.0.1+10-3ubuntu110.0.2+13-1ubuntu0.18.04.110.0.2+13-1ubuntu0.18.04.210.0.2+13-1ubuntu0.18.04.310.0.2+13-1ubuntu0.18.04.411.0.2+9-3ubuntu1~18.04.311.0.3+7-1ubuntu2~18.04.111.0.4+11-1ubuntu2~18.04.311.0.5+10-0ubuntu1.1~18.0411.0.6+10-1ubuntu1~18.04.111.0.7+10-2ubuntu2~18.0411.0.8+10-0ubuntu1~18.04.111.0.9+11-0ubuntu1~18.04.111.0.9.1+1-0ubuntu1~18.0411.0.10+9-0ubuntu1~18.0411.0.11+9-0ubuntu2~18.0411.0.13+8-0ubuntu1~18.0411.0.14+9-0ubuntu2~18.0411.0.14.1+1-0ubuntu1~18.0411.0.15+10-0ubuntu0.18.04.111.0.16+8-0ubuntu1~18.04	11.0.17+8-1ubuntu2~18.04
`openjdk-17` Ubuntu:20.04:LTS	before 17.0.5+8-2ubuntu1~20.04, plus listed versions 17+35-1~20.0417.0.1+12-1~20.0417.0.2+8-1~20.0417.0.3+7-0ubuntu0.20.04.117.0.4+8-1~20.04	17.0.5+8-2ubuntu1~20.04
`openjdk-8` Ubuntu:20.04:LTS	before 8u352-ga-1~20.04, plus listed versions 8u232-b09-0ubuntu18u232-b09-18u242-b04-18u242-b08-0ubuntu38u252-b07-1 Show 8 moreShow less 8u252-b09-1ubuntu18u265-b01-0ubuntu2~20.048u272-b10-0ubuntu1~20.048u275-b01-0ubuntu1~20.048u282-b08-0ubuntu1~20.048u292-b10-0ubuntu1~20.048u312-b07-0ubuntu1~20.048u342-b07-0ubuntu1~20.04	8u352-ga-1~20.04
`openjdk-lts` Ubuntu:20.04:LTS	before 11.0.17+8-1ubuntu2~20.04, plus listed versions 11.0.5+10-0ubuntu111.0.5+10-2ubuntu111.0.6+10-1ubuntu111.0.6+10-2ubuntu211.0.7+9-1ubuntu1 Show 12 moreShow less 11.0.7+10-2ubuntu111.0.7+10-3ubuntu111.0.8+10-0ubuntu1~20.0411.0.9+11-0ubuntu1~20.0411.0.9.1+1-0ubuntu1~20.0411.0.10+9-0ubuntu1~20.0411.0.11+9-0ubuntu2~20.0411.0.13+8-0ubuntu1~20.0411.0.14+9-0ubuntu2~20.0411.0.14.1+1-0ubuntu1~20.0411.0.15+10-0ubuntu0.20.04.111.0.16+8-0ubuntu1~20.04	11.0.17+8-1ubuntu2~20.04
`openjdk-13` Ubuntu:20.04:LTS	All versions, plus listed versions 13+33-113.0.1+9-213.0.2+8-113.0.2+8-213.0.3+3-1ubuntu213.0.4+8-1~20.0413.0.7+5-0ubuntu1~20.04	None known
`openjdk-16` Ubuntu:20.04:LTS	All versions, plus listed versions 16.0.1+9-1~20.04	None known
`openjdk-17` Ubuntu:22.04:LTS	before 17.0.5+8-2ubuntu1~22.04, plus listed versions 17+35-117.0.1+12-117.0.2+8-117.0.3+7-0ubuntu0.22.04.117.0.4+8-1~22.04	17.0.5+8-2ubuntu1~22.04
`openjdk-18` Ubuntu:22.04:LTS	All versions, plus listed versions 18~15ea-418~20ea-118~32ea-118~36ea-118.0.2+9-2~22.04	None known
`openjdk-19` Ubuntu:22.04:LTS	before 19.0.1+10-1ubuntu1~22.04	19.0.1+10-1ubuntu1~22.04
`openjdk-8` Ubuntu:22.04:LTS	before 8u352-ga-1~22.04, plus listed versions 8u302-b08-0ubuntu28u312-b07-0ubuntu18u342-b07-0ubuntu1~22.04	8u352-ga-1~22.04
`openjdk-lts` Ubuntu:22.04:LTS	before 11.0.17+8-1ubuntu2~22.04, plus listed versions 11.0.12+7-0ubuntu311.0.13+8-0ubuntu111.0.14+9-0ubuntu211.0.14.1+1-0ubuntu111.0.15+10-0ubuntu0.22.04.111.0.16+8-0ubuntu1~22.04	11.0.17+8-1ubuntu2~22.04
`openjdk-8` Ubuntu:Pro:16.04:LTS From an advisory covering 6 CVEs	before 8u352-ga-1~16.04, plus listed versions 8u66-b01-58u72-b05-1ubuntu18u72-b05-58u72-b05-68u72-b15-1 Show 33 moreShow less 8u72-b15-2ubuntu18u72-b15-2ubuntu38u72-b15-3ubuntu18u77-b03-1ubuntu28u77-b03-3ubuntu18u77-b03-3ubuntu28u77-b03-3ubuntu38u91-b14-0ubuntu4~16.04.18u91-b14-3ubuntu1~16.04.18u111-b14-2ubuntu0.16.04.28u121-b13-0ubuntu1.16.04.28u131-b11-0ubuntu1.16.04.28u131-b11-2ubuntu1.16.04.28u131-b11-2ubuntu1.16.04.38u151-b12-0ubuntu0.16.04.28u162-b12-0ubuntu0.16.04.28u171-b11-0ubuntu0.16.04.18u181-b13-0ubuntu0.16.04.18u181-b13-1ubuntu0.16.04.18u191-b12-0ubuntu0.16.04.18u191-b12-2ubuntu0.16.04.18u212-b03-0ubuntu1.16.04.18u222-b10-1ubuntu1~16.04.18u232-b09-0ubuntu1~16.04.18u242-b08-0ubuntu3~16.048u252-b09-1~16.048u265-b01-0ubuntu2~16.048u272-b10-0ubuntu1~16.048u275-b01-0ubuntu1~16.048u282-b08-0ubuntu1~16.048u292-b10-0ubuntu1~16.04.18u312-b07-0ubuntu1~16.048u342-b07-0ubuntu1~16.04	8u352-ga-1~16.04
`openjdk-17` Ubuntu:18.04:LTS From an advisory covering 6 CVEs	before 17.0.5+8-2ubuntu1~18.04, plus listed versions 17+35-1~18.0417.0.1+12-1~18.0417.0.2+8-1~18.0417.0.3+7-0ubuntu0.18.04.117.0.4+8-1~18.04	17.0.5+8-2ubuntu1~18.04
`openjdk-8` Ubuntu:18.04:LTS From an advisory covering 6 CVEs	before 8u352-ga-1~18.04, plus listed versions 8u144-b01-28u151-b12-18u162-b12-18u171-b11-0ubuntu0.18.04.18u181-b13-0ubuntu0.18.04.1 Show 15 moreShow less 8u181-b13-1ubuntu0.18.04.18u191-b12-0ubuntu0.18.04.18u191-b12-2ubuntu0.18.04.18u212-b03-0ubuntu1.18.04.18u222-b10-1ubuntu1~18.04.18u232-b09-0ubuntu1~18.04.18u242-b08-0ubuntu3~18.048u252-b09-1~18.048u265-b01-0ubuntu2~18.048u272-b10-0ubuntu1~18.048u275-b01-0ubuntu1~18.048u282-b08-0ubuntu1~18.048u292-b10-0ubuntu1~18.048u312-b07-0ubuntu1~18.048u342-b07-0ubuntu1~18.04	8u352-ga-1~18.04
`openjdk-lts` Ubuntu:18.04:LTS From an advisory covering 6 CVEs	before 11.0.17+8-1ubuntu2~18.04, plus listed versions 9.0.4+12-2ubuntu49.0.4+12-4ubuntu110~46-4ubuntu110~46-5ubuntu110.0.1+10-1ubuntu2 Show 21 moreShow less 10.0.1+10-3ubuntu110.0.2+13-1ubuntu0.18.04.110.0.2+13-1ubuntu0.18.04.210.0.2+13-1ubuntu0.18.04.310.0.2+13-1ubuntu0.18.04.411.0.2+9-3ubuntu1~18.04.311.0.3+7-1ubuntu2~18.04.111.0.4+11-1ubuntu2~18.04.311.0.5+10-0ubuntu1.1~18.0411.0.6+10-1ubuntu1~18.04.111.0.7+10-2ubuntu2~18.0411.0.8+10-0ubuntu1~18.04.111.0.9+11-0ubuntu1~18.04.111.0.9.1+1-0ubuntu1~18.0411.0.10+9-0ubuntu1~18.0411.0.11+9-0ubuntu2~18.0411.0.13+8-0ubuntu1~18.0411.0.14+9-0ubuntu2~18.0411.0.14.1+1-0ubuntu1~18.0411.0.15+10-0ubuntu0.18.04.111.0.16+8-0ubuntu1~18.04	11.0.17+8-1ubuntu2~18.04
`openjdk-17` Ubuntu:20.04:LTS From an advisory covering 6 CVEs	before 17.0.5+8-2ubuntu1~20.04, plus listed versions 17+35-1~20.0417.0.1+12-1~20.0417.0.2+8-1~20.0417.0.3+7-0ubuntu0.20.04.117.0.4+8-1~20.04	17.0.5+8-2ubuntu1~20.04
`openjdk-8` Ubuntu:20.04:LTS From an advisory covering 6 CVEs	before 8u352-ga-1~20.04, plus listed versions 8u232-b09-0ubuntu18u232-b09-18u242-b04-18u242-b08-0ubuntu38u252-b07-1 Show 8 moreShow less 8u252-b09-1ubuntu18u265-b01-0ubuntu2~20.048u272-b10-0ubuntu1~20.048u275-b01-0ubuntu1~20.048u282-b08-0ubuntu1~20.048u292-b10-0ubuntu1~20.048u312-b07-0ubuntu1~20.048u342-b07-0ubuntu1~20.04	8u352-ga-1~20.04
`openjdk-lts` Ubuntu:20.04:LTS From an advisory covering 6 CVEs	before 11.0.17+8-1ubuntu2~20.04, plus listed versions 11.0.5+10-0ubuntu111.0.5+10-2ubuntu111.0.6+10-1ubuntu111.0.6+10-2ubuntu211.0.7+9-1ubuntu1 Show 12 moreShow less 11.0.7+10-2ubuntu111.0.7+10-3ubuntu111.0.8+10-0ubuntu1~20.0411.0.9+11-0ubuntu1~20.0411.0.9.1+1-0ubuntu1~20.0411.0.10+9-0ubuntu1~20.0411.0.11+9-0ubuntu2~20.0411.0.13+8-0ubuntu1~20.0411.0.14+9-0ubuntu2~20.0411.0.14.1+1-0ubuntu1~20.0411.0.15+10-0ubuntu0.20.04.111.0.16+8-0ubuntu1~20.04	11.0.17+8-1ubuntu2~20.04
`openjdk-17` Ubuntu:22.04:LTS From an advisory covering 6 CVEs	before 17.0.5+8-2ubuntu1~22.04, plus listed versions 17+35-117.0.1+12-117.0.2+8-117.0.3+7-0ubuntu0.22.04.117.0.4+8-1~22.04	17.0.5+8-2ubuntu1~22.04
`openjdk-19` Ubuntu:22.04:LTS From an advisory covering 6 CVEs	before 19.0.1+10-1ubuntu1~22.04	19.0.1+10-1ubuntu1~22.04
`openjdk-8` Ubuntu:22.04:LTS From an advisory covering 6 CVEs	before 8u352-ga-1~22.04, plus listed versions 8u302-b08-0ubuntu28u312-b07-0ubuntu18u342-b07-0ubuntu1~22.04	8u352-ga-1~22.04
`openjdk-lts` Ubuntu:22.04:LTS From an advisory covering 6 CVEs	before 11.0.17+8-1ubuntu2~22.04, plus listed versions 11.0.12+7-0ubuntu311.0.13+8-0ubuntu111.0.14+9-0ubuntu211.0.14.1+1-0ubuntu111.0.15+10-0ubuntu0.22.04.111.0.16+8-0ubuntu1~22.04	11.0.17+8-1ubuntu2~22.04
`java-11-openjdk` openSUSE:Tumbleweed From an advisory covering 6 CVEs	before 11.0.17.0-1.1	11.0.17.0-1.1
`java-17-openjdk` openSUSE:Tumbleweed From an advisory covering 5 CVEs	before 17.0.5.0-1.1	17.0.5.0-1.1
`java-13-openjdk` openSUSE:Tumbleweed From an advisory covering 6 CVEs	before 13.0.13.0-1.1	13.0.13.0-1.1
`java-15-openjdk` openSUSE:Tumbleweed From an advisory covering 6 CVEs	before 15.0.9.0-1.1	15.0.9.0-1.1
`java-11-openj9` openSUSE:Tumbleweed From an advisory covering 4 CVEs	before 11.0.17.0-1.1	11.0.17.0-1.1
`java-17-openj9` openSUSE:Tumbleweed From an advisory covering 4 CVEs	before 17.0.5.0-1.1	17.0.5.0-1.1
`java-19-openjdk` openSUSE:Tumbleweed From an advisory covering 5 CVEs	before 19.0.1.0-1.1	19.0.1.0-1.1
`java-1_8_0-openjdk` openSUSE:Tumbleweed From an advisory covering 4 CVEs	before 1.8.0.352-1.1	1.8.0.352-1.1
`java-11-openj9` openSUSE:Leap 15.6 From an advisory covering 58 CVEs	before 11.0.26.0-bp156.4.3.1	11.0.26.0-bp156.4.3.1
`java-17-openj9` openSUSE:Leap 15.6 From an advisory covering 47 CVEs	before 17.0.14.0-bp156.3.3.1	17.0.14.0-bp156.3.3.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts	OSV
Nov 3, 2026	affected, aliases, references	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-21628 is a medium vulnerability (CVSS 5.3) in Oracle Graalvm, published October 18, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.88%, the 86th percentile. Fixed in openjdk11 11.0.17_p8-r0.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 540 package rows, 18 versions, 96 references and the rest of 4 source descriptions. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 16 source records.