CVE-2026-60589

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...

3.7 LowFix available

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.27%Unchanged since Aug 19, 2026

What each source reports

CVE List Score used 3.7

Record: CVE-2026-60589
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

EUVDEUVD-2026-61389 3.7

Record: EUVD-2026-61389
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-47g6-3p6h-6cpc 3.7

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...

Record: GHSA-47g6-3p6h-6cpc
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

NVD 3.7

Record: CVE-2026-60589
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVBELL-CVE-2026-60589 3.7

Record: BELL-CVE-2026-60589
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-60589 3.7

Record: DEBIAN-CVE-2026-60589
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-03

Show 48 moreShow less

OSVOESA-2026-3737 8.2

openjdk-1.8.0 security update

Security Fix(es):

Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c(CVE-2023-48161)

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.(CVE-2025-64506)

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.(CVE-2025-65018)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).(CVE-2026-22007)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an…

Record: OESA-2026-3737
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-02

OSVOESA-2026-3738 8.2

openjdk-1.8.0 security update

Security Fix(es):

Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c(CVE-2023-48161)

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.(CVE-2025-65018)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).(CVE-2026-22007)

Record: OESA-2026-3738
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-02

OSVOESA-2026-3739 7.5

openjdk-1.8.0 security update

The OpenJDK runtime environment 8.

Security Fix(es):

zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.(CVE-2026-27171)

Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.(CVE-2026-41254)

Vulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).(CVE-2026-46968)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).(CVE-2026-47059)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).(CVE-2026-47063)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise…

Record: OESA-2026-3739
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-3740 8.2

openjdk-1.8.0 security update

Security Fix(es):

Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c(CVE-2023-48161)

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive(CVE-2025-28162)

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.(CVE-2025-28164)

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.(CVE-2025-65018)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in…

Record: OESA-2026-3740
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-02

OSVOESA-2026-3741 8.2

openjdk-1.8.0 security update

Security Fix(es):

Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c(CVE-2023-48161)

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function png_image_finish_read when processing 16-bit interlaced PNGs with 8-bit output format. Attacker-crafted interlaced PNG files cause heap writes beyond allocated buffer bounds. This issue has been patched in version 1.6.51.(CVE-2025-65018)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).(CVE-2026-22007)

Record: OESA-2026-3741
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated: 2026-11-02

OSVOESA-2026-3750 7.5

openjdk-17 security update

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2026-21925)

Record: OESA-2026-3750
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-3751 7.5

openjdk-17 security update

The OpenJDK runtime environment.

Security Fix(es):

Record: OESA-2026-3751
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-3752 7.5

openjdk-17 security update

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).(CVE-2025-53066)

Record: OESA-2026-3752
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVOESA-2026-3753 7.5

openjdk-17 security update

The OpenJDK runtime environment.

Security Fix(es):

Record: OESA-2026-3753
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-3754 7.5

openjdk-17 security update

The OpenJDK runtime environment.

Security Fix(es):

Record: OESA-2026-3754
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-3759 8.6

openjdk-21 security update

The OpenJDK runtime environment.

Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.(CVE-2025-28164)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).(CVE-2025-30749)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2025-30754)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies…

Record: OESA-2026-3759
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVOESA-2026-3760 8.6

openjdk-21 security update

The OpenJDK runtime environment.

Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.(CVE-2025-28164)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).(CVE-2025-30749)

Record: OESA-2026-3760
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVOESA-2026-3761 8.6

openjdk-21 security update

The OpenJDK runtime environment.

Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.(CVE-2025-28164)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).(CVE-2025-30749)

Record: OESA-2026-3761
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVOESA-2026-3835 6.8

openjdk-25 security update

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N).(CVE-2026-61308)

Record: OESA-2026-3835
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVOESA-2026-3836 6.8

openjdk-25 security update

The OpenJDK runtime environment.

Security Fix(es):

Record: OESA-2026-3836
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVOESA-2026-3927 8.6

openjdk-21 security update

The OpenJDK runtime environment.

Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.(CVE-2025-28164)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).(CVE-2025-30749)

Record: OESA-2026-3927
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVOESA-2026-3951 6.8

openjdk-25 security update

The OpenJDK runtime environment.

Security Fix(es):

Record: OESA-2026-3951
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:55774 6.8

Red Hat Security Advisory: java-1.8.0-openjdk security update

Record: RHSA-2026:55774
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:55775 6.8

Red Hat Security Advisory: java-1.8.0-openjdk security update

Record: RHSA-2026:55775
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:55778 6.8

Red Hat Security Advisory: Java 11 OpenJDK ELS Security Update

Record: RHSA-2026:55778
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:55781 6.8

Red Hat Security Advisory: java-17-openjdk security update

Record: RHSA-2026:55781
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:55787 6.8

Red Hat Security Advisory: java-21-openjdk security update

Record: RHSA-2026:55787
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:55798 7.5

Red Hat Security Advisory: java-25-openjdk security update

Record: RHSA-2026:55798
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:57175 6.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:57175
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:57177 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:57177
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:57765 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:57765
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:58266 6.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:58266
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:70630 6.8

Red Hat Security Advisory: java-1.8.0-ibm security update

Record: RHSA-2026:70630
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:72888 6.8

Red Hat Security Advisory: java-21-ibm-semeru-certified-jdk security update

Record: RHSA-2026:72888
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRLSA-2026:55775 6.8

Moderate: java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

JDK: Improve Resource Resolving (CVE-2026-60589)
JDK: Enhance HTTP Connections (CVE-2026-61308)
JDK: Enhance TLS server (CVE-2026-70907)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:55775
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRLSA-2026:55781 6.8

Moderate: java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

JDK: Improve Resource Resolving (CVE-2026-60589)
JDK: Enhance HTTP Connections (CVE-2026-61308)
JDK: Enhance TLS server (CVE-2026-70907)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:55781
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRLSA-2026:55787 6.8

Moderate: java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.

Security Fix(es):

JDK: Improve Resource Resolving (CVE-2026-60589)
JDK: Enhance HTTP Connections (CVE-2026-61308)
JDK: Enhance TLS server (CVE-2026-70907)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:55787
CVSS 3.1: 6.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRLSA-2026:55798 7.5

Moderate: java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit.

Security Fix(es):

JDK: Improve Resource Resolving (CVE-2026-60589)
JDK: Enhance HTTP Connections (CVE-2026-61308)
JDK: Improve font loading (CVE-2026-70906)
JDK: Enhance TLS server (CVE-2026-70907)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:55798
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-60589 3.7

Record: UBUNTU-CVE-2026-60589
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVALSA-2026:55775 No score

Moderate: java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

JDK: Improve Resource Resolving (CVE-2026-60589)
JDK: Enhance HTTP Connections (CVE-2026-61308)
JDK: Enhance TLS server (CVE-2026-70907)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:55775
Updated: 2026-11-02

OSVALSA-2026:55781 No score

Moderate: java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

JDK: Improve Resource Resolving (CVE-2026-60589)
JDK: Enhance HTTP Connections (CVE-2026-61308)
JDK: Enhance TLS server (CVE-2026-70907)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:55781
Updated: 2026-11-02

OSVALSA-2026:55787 No score

Moderate: java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.

Security Fix(es):

JDK: Improve Resource Resolving (CVE-2026-60589)
JDK: Enhance HTTP Connections (CVE-2026-61308)
JDK: Enhance TLS server (CVE-2026-70907)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:55787
Updated: 2026-11-02

OSVALSA-2026:55798 No score

Moderate: java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit.

Security Fix(es):

JDK: Improve Resource Resolving (CVE-2026-60589)
JDK: Enhance HTTP Connections (CVE-2026-61308)
JDK: Improve font loading (CVE-2026-70906)
JDK: Enhance TLS server (CVE-2026-70907)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:55798
Updated: 2026-11-02

OSVBIT-java-2026-60589 No score

Record: BIT-java-2026-60589
Updated: 2026-11-02

OSVBIT-java-min-2026-60589 No score

Record: BIT-java-min-2026-60589
Updated: 2026-11-02

OSVBIT-jre-2026-60589 No score

Record: BIT-jre-2026-60589
Updated: 2026-11-02

OSVCLSA-2026-1787735855 No score

java-1.8.0-openjdk: Fix of 5 CVEs

Update to shenandoah-jdk8u504-b01
Security fixes from OpenJDK 8u504-b01:
- CVE-2026-60589: improve resource resolving
- CVE-2026-61308: enhance HTTP connections
- CVE-2026-70907: enhance TLS server

Record: CLSA-2026-1787735855
Updated: 2026-11-02

OSVCLSA-2026-1787785077 No score

java-17-openjdk: Fix of 3 CVEs

Update to jdk-17.0.20.1+1 (GA)
CVE-2026-60589: Improve Resource Resolving
CVE-2026-61308: Enhance HTTP Connections
CVE-2026-70907: Enhance TLS server

Record: CLSA-2026-1787785077
Updated: 2026-11-02

OSVCLSA-2026-1787786503 No score

java-1.8.0-openjdk: Fix of 3 CVEs

Update to shenandoah-jdk8u504-b01
Security fixes from OpenJDK 8u504-b01:
- CVE-2026-60589: improve resource resolving
- CVE-2026-61308: enhance HTTP connections
- CVE-2026-70907: enhance TLS server

Record: CLSA-2026-1787786503
Updated: 2026-11-02

OSVCLSA-2026-1787788030 No score

java-21-openjdk: Fix of 3 CVEs

Update to jdk-21.0.12.1+1 (GA)
CVE-2026-60589: Improve Resource Resolving
CVE-2026-61308: Enhance HTTP Connections
CVE-2026-70907: Enhance TLS server

Record: CLSA-2026-1787788030
Updated: 2026-11-02

OSVCLSA-2026-1788193524 No score

java-17-openjdk: Fix of 11 CVEs

Update to jdk-17.0.20.1+1 (RHSA-2026:55781)
CVE-2026-70907: enhance TLS server, so that a TLS 1.3 server cannot send a second HelloRetryRequest in the same connection
CVE-2026-61308: enhance HTTP connections, so that the Proxy-Authorization header is dropped once the proxy in use changes across a redirect and while a tunnel is being established
CVE-2026-60589: improve resource resolving, so that the XML signature resolvers parse the URI scheme instead of prefix matching on it

Record: CLSA-2026-1788193524
Updated: 2026-11-02

OSVCLSA-2026-1790243357 No score

java-11-openjdk: Fix of 3 CVEs

Upgrade to openjdk-11.0.32.1+1 (GA). The following CVEs were fixed:
CVE-2026-60589: improve resource resolving
CVE-2026-61308: enhance HTTP connections
CVE-2026-70907: enhance TLS server
Update bundled FreeType to 2.14.3 following JDK-8385390

Record: CLSA-2026-1790243357
Updated: 2026-11-02

OSVCLSA-2026-1790244896 No score

java-11-openjdk: Fix of 3 CVEs

Upgrade to openjdk-11.0.32.1+1 (GA). The following CVEs were fixed:
CVE-2026-60589: improve resource resolving
CVE-2026-61308: enhance HTTP connections
CVE-2026-70907: enhance TLS server
Update bundled FreeType to 2.14.3 following JDK-8385390

Record: CLSA-2026-1790244896
Updated: 2026-11-02

Affected products

oracle corporation java se, oracle graalvm for jdk, oracle graalvm enterprise edition

Affected packages

Affected packages
Package	Affected	Fixed
`java-1.8.0-openjdk` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-accessibility` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-accessibility-fastdebug` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-accessibility-slowdebug` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-demo` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-demo-fastdebug` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-demo-slowdebug` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-devel` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-devel-fastdebug` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-devel-slowdebug` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8

Show 290 moreShow less

Affected packages
Package	Affected	Fixed
`java-1.8.0-openjdk-fastdebug` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-headless` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-headless-fastdebug` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-headless-slowdebug` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-javadoc` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-javadoc-zip` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-slowdebug` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-src` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-src-fastdebug` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-src-slowdebug` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk` AlmaLinux:9 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.2.el9.alma.1	1:1.8.0.504.b01-1.2.el9.alma.1
`java-1.8.0-openjdk-demo` AlmaLinux:9 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.2.el9.alma.1	1:1.8.0.504.b01-1.2.el9.alma.1
`java-1.8.0-openjdk-demo-fastdebug` AlmaLinux:9 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.2.el9.alma.1	1:1.8.0.504.b01-1.2.el9.alma.1
`java-1.8.0-openjdk-demo-slowdebug` AlmaLinux:9 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.2.el9.alma.1	1:1.8.0.504.b01-1.2.el9.alma.1
`java-1.8.0-openjdk-devel` AlmaLinux:9 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.2.el9.alma.1	1:1.8.0.504.b01-1.2.el9.alma.1
`java-1.8.0-openjdk-devel-fastdebug` AlmaLinux:9 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.2.el9.alma.1	1:1.8.0.504.b01-1.2.el9.alma.1
`java-1.8.0-openjdk-devel-slowdebug` AlmaLinux:9 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.2.el9.alma.1	1:1.8.0.504.b01-1.2.el9.alma.1
`java-1.8.0-openjdk-fastdebug` AlmaLinux:9 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.2.el9.alma.1	1:1.8.0.504.b01-1.2.el9.alma.1
`java-1.8.0-openjdk-headless` AlmaLinux:9 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.2.el9.alma.1	1:1.8.0.504.b01-1.2.el9.alma.1
`java-1.8.0-openjdk-headless-fastdebug` AlmaLinux:9 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.2.el9.alma.1	1:1.8.0.504.b01-1.2.el9.alma.1
`java-1.8.0-openjdk-headless-slowdebug` AlmaLinux:9 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.2.el9.alma.1	1:1.8.0.504.b01-1.2.el9.alma.1
`java-1.8.0-openjdk-javadoc` AlmaLinux:9 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.2.el9.alma.1	1:1.8.0.504.b01-1.2.el9.alma.1
`java-1.8.0-openjdk-javadoc-zip` AlmaLinux:9 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.2.el9.alma.1	1:1.8.0.504.b01-1.2.el9.alma.1
`java-1.8.0-openjdk-slowdebug` AlmaLinux:9 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.2.el9.alma.1	1:1.8.0.504.b01-1.2.el9.alma.1
`java-1.8.0-openjdk-src` AlmaLinux:9 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.2.el9.alma.1	1:1.8.0.504.b01-1.2.el9.alma.1
`java-1.8.0-openjdk-src-fastdebug` AlmaLinux:9 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.2.el9.alma.1	1:1.8.0.504.b01-1.2.el9.alma.1
`java-1.8.0-openjdk-src-slowdebug` AlmaLinux:9 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.2.el9.alma.1	1:1.8.0.504.b01-1.2.el9.alma.1
`java-17-openjdk` AlmaLinux:8 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.1.el8	1:17.0.20.1.1-1.1.el8
`openjdk-nik-23-17` Alpaquita:23	23.0.4-r1 up to 23.0.13.1-r0	23.0.13.1-r0
`openjdk-nik-23-21` Alpaquita:23	23.1.3-r1 up to 23.1.12.1-r0	23.1.12.1-r0
`openjdk-nik-25-25` Alpaquita:23	25.0.0-r0 up to 25.0.4.1-r0	25.0.4.1-r0
`openjdk11` Alpaquita:23	11.0.19_p7-r0 up to 11.0.32.1_p1-r0	11.0.32.1_p1-r0
`openjdk11-container-jre` Alpaquita:23	11.0.19_p7-r0 up to 11.0.32.1_p1-r0	11.0.32.1_p1-r0
`openjdk11-lite` Alpaquita:23	11.0.19_p7-r1 up to 11.0.32.1_p1-r0	11.0.32.1_p1-r0
`openjdk11-perf` Alpaquita:23	11.0.20.1_p1-r0 up to 11.0.32.1_p2-r0	11.0.32.1_p2-r0
`openjdk17` Alpaquita:23	17.0.7_p7-r1 up to 17.0.20.1_p1-r0	17.0.20.1_p1-r0
`openjdk17-container-jre` Alpaquita:23	17.0.7_p7-r0 up to 17.0.20.1_p1-r0	17.0.20.1_p1-r0
`openjdk17-crac` Alpaquita:23	17.0.13_p13-r0 up to 17.0.20.1_p2-r0	17.0.20.1_p2-r0
`openjdk17-lite` Alpaquita:23	17.0.7_p7-r1 up to 17.0.20.1_p1-r0	17.0.20.1_p1-r0
`openjdk21` Alpaquita:23	21_p37-r0 up to 21.0.12.1_p1-r0	21.0.12.1_p1-r0
`openjdk21-container-jre` Alpaquita:23	21_p37-r0 up to 21.0.12.1_p1-r0	21.0.12.1_p1-r0
`openjdk21-crac` Alpaquita:23	21.0.5_p12-r0 up to 21.0.12.1_p2-r0	21.0.12.1_p2-r0
`openjdk21-lite` Alpaquita:23	21_p37-r0 up to 21.0.12.1_p1-r0	21.0.12.1_p1-r0
`openjdk25` Alpaquita:23	25_p37-r0 up to 25.0.4.1_p1-r0	25.0.4.1_p1-r0
`openjdk25-container-jre` Alpaquita:23	25_p37-r0 up to 25.0.4.1_p1-r0	25.0.4.1_p1-r0
`openjdk25-lite` Alpaquita:23	25_p37-r0 up to 25.0.4.1_p1-r0	25.0.4.1_p1-r0
`openjdk26` Alpaquita:23	26_p37-r0 up to 26.0.2.1_p1-r0	26.0.2.1_p1-r0
`openjdk26-container-jre` Alpaquita:23	26_p37-r0 up to 26.0.2.1_p1-r0	26.0.2.1_p1-r0
`openjdk26-lite` Alpaquita:23	26_p37-r0 up to 26.0.2.1_p1-r0	26.0.2.1_p1-r0
`openjdk8` Alpaquita:23	8u372_p7-r0 up to 8.504_p1-r0	8.504_p1-r0
`openjdk8-perf` Alpaquita:23	8u392_p9-r1 up to 8.504_p2-r0	8.504_p2-r0
`openjdk-nik-23-17` Alpaquita:25	23.0.8-r0 up to 23.0.13.1-r0	23.0.13.1-r0
`openjdk-nik-23-21` Alpaquita:25	23.1.7-r0 up to 23.1.12.1-r0	23.1.12.1-r0
`openjdk-nik-25-25` Alpaquita:25	25.0.0-r0 up to 25.0.4.1-r0	25.0.4.1-r0
`openjdk11` Alpaquita:25	11.0.27_p9-r0 up to 11.0.32.1_p1-r0	11.0.32.1_p1-r0
`openjdk11-container-jre` Alpaquita:25	11.0.27_p9-r0 up to 11.0.32.1_p1-r0	11.0.32.1_p1-r0
`openjdk11-lite` Alpaquita:25	11.0.27_p9-r0 up to 11.0.32.1_p1-r0	11.0.32.1_p1-r0
`openjdk11-perf` Alpaquita:25	11.0.29_p11-r0 up to 11.0.32.1_p2-r0	11.0.32.1_p2-r0
`openjdk17` Alpaquita:25	17.0.15_p10-r1 up to 17.0.20.1_p1-r0	17.0.20.1_p1-r0
`openjdk17-container-jre` Alpaquita:25	17.0.15_p10-r0 up to 17.0.20.1_p1-r0	17.0.20.1_p1-r0
`openjdk17-crac` Alpaquita:25	17.0.15_p13-r1 up to 17.0.20.1_p2-r0	17.0.20.1_p2-r0
`openjdk17-lite` Alpaquita:25	17.0.15_p10-r0 up to 17.0.20.1_p1-r0	17.0.20.1_p1-r0
`openjdk21` Alpaquita:25	21.0.7_p9-r1 up to 21.0.12.1_p1-r0	21.0.12.1_p1-r0
`openjdk21-container-jre` Alpaquita:25	21.0.7_p9-r0 up to 21.0.12.1_p1-r0	21.0.12.1_p1-r0
`openjdk21-crac` Alpaquita:25	21.0.7_p12-r1 up to 21.0.12.1_p2-r0	21.0.12.1_p2-r0
`openjdk21-lite` Alpaquita:25	21.0.7_p9-r0 up to 21.0.12.1_p1-r0	21.0.12.1_p1-r0
`openjdk-nik-23-17` BellSoft Hardened Containers:23	23.0.4-r1 up to 23.0.13.1-r0	23.0.13.1-r0
`openjdk-nik-23-21` BellSoft Hardened Containers:23	23.1.3-r1 up to 23.1.12.1-r0	23.1.12.1-r0
`openjdk-nik-25-25` BellSoft Hardened Containers:23	25.0.0-r0 up to 25.0.4.1-r0	25.0.4.1-r0
`openjdk11-container-jre` BellSoft Hardened Containers:23	11.0.19_p7-r0 up to 11.0.32.1_p1-r0	11.0.32.1_p1-r0
`openjdk11-lite` BellSoft Hardened Containers:23	11.0.19_p7-r1 up to 11.0.32.1_p1-r0	11.0.32.1_p1-r0
`openjdk11-perf` BellSoft Hardened Containers:23	11.0.20.1_p1-r0 up to 11.0.32.1_p2-r0	11.0.32.1_p2-r0
`openjdk17-container-jre` BellSoft Hardened Containers:23	17.0.7_p7-r0 up to 17.0.20.1_p1-r0	17.0.20.1_p1-r0
`openjdk17-crac` BellSoft Hardened Containers:23	17.0.13_p13-r0 up to 17.0.20.1_p2-r0	17.0.20.1_p2-r0
`openjdk17-lite` BellSoft Hardened Containers:23	17.0.7_p7-r1 up to 17.0.20.1_p1-r0	17.0.20.1_p1-r0
`openjdk21-container-jre` BellSoft Hardened Containers:23	21_p37-r0 up to 21.0.12.1_p1-r0	21.0.12.1_p1-r0
`openjdk21-crac` BellSoft Hardened Containers:23	21.0.5_p12-r0 up to 21.0.12.1_p2-r0	21.0.12.1_p2-r0
`openjdk21-lite` BellSoft Hardened Containers:23	21_p37-r0 up to 21.0.12.1_p1-r0	21.0.12.1_p1-r0
`openjdk25-container-jre` BellSoft Hardened Containers:23	25_p37-r0 up to 25.0.4.1_p1-r0	25.0.4.1_p1-r0
`openjdk25-lite` BellSoft Hardened Containers:23	25_p37-r0 up to 25.0.4.1_p1-r0	25.0.4.1_p1-r0
`openjdk26-container-jre` BellSoft Hardened Containers:23	26_p37-r0 up to 26.0.2.1_p1-r0	26.0.2.1_p1-r0
`openjdk26-lite` BellSoft Hardened Containers:23	26_p37-r0 up to 26.0.2.1_p1-r0	26.0.2.1_p1-r0
`openjdk8` BellSoft Hardened Containers:23	8u372_p7-r0 up to 8.504_p1-r0	8.504_p1-r0
`openjdk8-perf` BellSoft Hardened Containers:23	8u392_p9-r1 up to 8.504_p2-r0	8.504_p2-r0
`openjdk-nik-23-17` BellSoft Hardened Containers:25	23.0.8-r0 up to 23.0.13.1-r0	23.0.13.1-r0
`openjdk-nik-23-21` BellSoft Hardened Containers:25	23.1.7-r0 up to 23.1.12.1-r0	23.1.12.1-r0
`openjdk-nik-25-25` BellSoft Hardened Containers:25	25.0.0-r0 up to 25.0.4.1-r0	25.0.4.1-r0
`openjdk11-container-jre` BellSoft Hardened Containers:25	11.0.27_p9-r0 up to 11.0.32.1_p1-r0	11.0.32.1_p1-r0
`openjdk11-lite` BellSoft Hardened Containers:25	11.0.27_p9-r0 up to 11.0.32.1_p1-r0	11.0.32.1_p1-r0
`openjdk11-perf` BellSoft Hardened Containers:25	11.0.29_p11-r0 up to 11.0.32.1_p2-r0	11.0.32.1_p2-r0
`openjdk17-container-jre` BellSoft Hardened Containers:25	17.0.15_p10-r0 up to 17.0.20.1_p1-r0	17.0.20.1_p1-r0
`openjdk17-crac` BellSoft Hardened Containers:25	17.0.15_p13-r1 up to 17.0.20.1_p2-r0	17.0.20.1_p2-r0
`openjdk17-lite` BellSoft Hardened Containers:25	17.0.15_p10-r0 up to 17.0.20.1_p1-r0	17.0.20.1_p1-r0
`openjdk21-container-jre` BellSoft Hardened Containers:25	21.0.7_p9-r0 up to 21.0.12.1_p1-r0	21.0.12.1_p1-r0
`openjdk21-crac` BellSoft Hardened Containers:25	21.0.7_p12-r1 up to 21.0.12.1_p2-r0	21.0.12.1_p2-r0
`openjdk21-lite` BellSoft Hardened Containers:25	21.0.7_p9-r0 up to 21.0.12.1_p1-r0	21.0.12.1_p1-r0
`openjdk25-container-jre` BellSoft Hardened Containers:25	25_p37-r0 up to 25.0.4.1_p1-r0	25.0.4.1_p1-r0
`openjdk25-lite` BellSoft Hardened Containers:25	25_p37-r0 up to 25.0.4.1_p1-r0	25.0.4.1_p1-r0
`openjdk26-container-jre` BellSoft Hardened Containers:25	26_p37-r0 up to 26.0.2.1_p1-r0	26.0.2.1_p1-r0
`openjdk26-lite` BellSoft Hardened Containers:25	26_p37-r0 up to 26.0.2.1_p1-r0	26.0.2.1_p1-r0
`openjdk8` BellSoft Hardened Containers:25	8.452_p11-r0 up to 8.504_p1-r0	8.504_p1-r0
`openjdk8-perf` BellSoft Hardened Containers:25	8.472_p10-r0 up to 8.504_p2-r0	8.504_p2-r0
`openjdk-nik-23-17` BellSoft Hardened Containers:stream	23.0.4-r1 up to 23.0.13.1-r0	23.0.13.1-r0
`java` Bitnami	before 1.8.0, 1.9.0 up to 8.0.503, 9.0.0 up to 11.0.32-1, 12.0.0 up to 17.0.20-1, 18.0.0 up to 21.0.12-1, 22.0.0 up to 25.0.4-1, 26.0.0 up to 26.0.2-1	1.8.08.0.50311.0.32-117.0.20-121.0.12-125.0.4-126.0.2-1
`java-min` Bitnami	before 1.8.0, 1.9.0 up to 8.0.503, 9.0.0 up to 11.0.32-1, 12.0.0 up to 17.0.20-1, 18.0.0 up to 21.0.12-1, 22.0.0 up to 25.0.4-1, 26.0.0 up to 26.0.2-1	1.8.08.0.50311.0.32-117.0.20-121.0.12-125.0.4-126.0.2-1
`jre` Bitnami	before 1.8.0, 1.9.0 up to 8.0.503, 9.0.0 up to 11.0.32-1, 12.0.0 up to 17.0.20-1, 18.0.0 up to 21.0.12-1, 22.0.0 up to 25.0.4-1, 26.0.0 up to 26.0.2-1	1.8.08.0.50311.0.32-117.0.20-121.0.12-125.0.4-126.0.2-1
`java-1.8.0-openjdk` TuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.el9.tuxcare.els1	1:1.8.0.504.b01-1.el9.tuxcare.els1
`java-1.8.0-openjdk-demo` TuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.el9.tuxcare.els1	1:1.8.0.504.b01-1.el9.tuxcare.els1
`java-1.8.0-openjdk-demo-fastdebug` TuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.el9.tuxcare.els1	1:1.8.0.504.b01-1.el9.tuxcare.els1
`java-1.8.0-openjdk-demo-slowdebug` TuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.el9.tuxcare.els1	1:1.8.0.504.b01-1.el9.tuxcare.els1
`java-1.8.0-openjdk-devel` TuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.el9.tuxcare.els1	1:1.8.0.504.b01-1.el9.tuxcare.els1
`java-1.8.0-openjdk-devel-fastdebug` TuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.el9.tuxcare.els1	1:1.8.0.504.b01-1.el9.tuxcare.els1
`java-1.8.0-openjdk-devel-slowdebug` TuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.el9.tuxcare.els1	1:1.8.0.504.b01-1.el9.tuxcare.els1
`java-1.8.0-openjdk-fastdebug` TuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.el9.tuxcare.els1	1:1.8.0.504.b01-1.el9.tuxcare.els1
`java-1.8.0-openjdk-headless` TuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.el9.tuxcare.els1	1:1.8.0.504.b01-1.el9.tuxcare.els1
`java-1.8.0-openjdk-headless-fastdebug` TuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.el9.tuxcare.els1	1:1.8.0.504.b01-1.el9.tuxcare.els1
`java-1.8.0-openjdk-headless-slowdebug` TuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.el9.tuxcare.els1	1:1.8.0.504.b01-1.el9.tuxcare.els1
`java-1.8.0-openjdk-javadoc` TuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.el9.tuxcare.els1	1:1.8.0.504.b01-1.el9.tuxcare.els1
`java-1.8.0-openjdk-javadoc-zip` TuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.el9.tuxcare.els1	1:1.8.0.504.b01-1.el9.tuxcare.els1
`java-1.8.0-openjdk-slowdebug` TuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.el9.tuxcare.els1	1:1.8.0.504.b01-1.el9.tuxcare.els1
`java-1.8.0-openjdk-src` TuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.el9.tuxcare.els1	1:1.8.0.504.b01-1.el9.tuxcare.els1
`java-1.8.0-openjdk-src-fastdebug` TuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.el9.tuxcare.els1	1:1.8.0.504.b01-1.el9.tuxcare.els1
`java-1.8.0-openjdk-src-slowdebug` TuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.el9.tuxcare.els1	1:1.8.0.504.b01-1.el9.tuxcare.els1
`java-17-openjdk` TuxCare:AlmaLinux:9.6 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.el9.tuxcare.els1	1:17.0.20.1.1-1.el9.tuxcare.els1
`java-17-openjdk-demo` TuxCare:AlmaLinux:9.6 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.el9.tuxcare.els1	1:17.0.20.1.1-1.el9.tuxcare.els1
`java-17-openjdk-demo-fastdebug` TuxCare:AlmaLinux:9.6 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.el9.tuxcare.els1	1:17.0.20.1.1-1.el9.tuxcare.els1
`java-17-openjdk-demo-slowdebug` TuxCare:AlmaLinux:9.6 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.el9.tuxcare.els1	1:17.0.20.1.1-1.el9.tuxcare.els1
`java-17-openjdk-devel` TuxCare:AlmaLinux:9.6 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.el9.tuxcare.els1	1:17.0.20.1.1-1.el9.tuxcare.els1
`java-17-openjdk-devel-fastdebug` TuxCare:AlmaLinux:9.6 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.el9.tuxcare.els1	1:17.0.20.1.1-1.el9.tuxcare.els1
`java-17-openjdk-devel-slowdebug` TuxCare:AlmaLinux:9.6 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.el9.tuxcare.els1	1:17.0.20.1.1-1.el9.tuxcare.els1
`java-17-openjdk-fastdebug` TuxCare:AlmaLinux:9.6 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.el9.tuxcare.els1	1:17.0.20.1.1-1.el9.tuxcare.els1
`java-17-openjdk-headless` TuxCare:AlmaLinux:9.6 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.el9.tuxcare.els1	1:17.0.20.1.1-1.el9.tuxcare.els1
`java-17-openjdk-headless-fastdebug` TuxCare:AlmaLinux:9.6 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.el9.tuxcare.els1	1:17.0.20.1.1-1.el9.tuxcare.els1
`java-17-openjdk-headless-slowdebug` TuxCare:AlmaLinux:9.6 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.el9.tuxcare.els1	1:17.0.20.1.1-1.el9.tuxcare.els1
`java-17-openjdk-javadoc` TuxCare:AlmaLinux:9.6 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.el9.tuxcare.els1	1:17.0.20.1.1-1.el9.tuxcare.els1
`java-17-openjdk-javadoc-zip` TuxCare:AlmaLinux:9.6 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.el9.tuxcare.els1	1:17.0.20.1.1-1.el9.tuxcare.els1
`java-17-openjdk-jmods` TuxCare:AlmaLinux:9.6 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.el9.tuxcare.els1	1:17.0.20.1.1-1.el9.tuxcare.els1
`java-17-openjdk-jmods-fastdebug` TuxCare:AlmaLinux:9.6 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.el9.tuxcare.els1	1:17.0.20.1.1-1.el9.tuxcare.els1
`java-17-openjdk-jmods-slowdebug` TuxCare:AlmaLinux:9.6 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.el9.tuxcare.els1	1:17.0.20.1.1-1.el9.tuxcare.els1
`java-17-openjdk-slowdebug` TuxCare:AlmaLinux:9.6 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.el9.tuxcare.els1	1:17.0.20.1.1-1.el9.tuxcare.els1
`java-17-openjdk-src` TuxCare:AlmaLinux:9.6 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.el9.tuxcare.els1	1:17.0.20.1.1-1.el9.tuxcare.els1
`java-17-openjdk-src-fastdebug` TuxCare:AlmaLinux:9.6 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.el9.tuxcare.els1	1:17.0.20.1.1-1.el9.tuxcare.els1
`java-17-openjdk-src-slowdebug` TuxCare:AlmaLinux:9.6 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.el9.tuxcare.els1	1:17.0.20.1.1-1.el9.tuxcare.els1
`openjdk-17` Debian:12	before 17.0.20.1+1-1~deb12u1, plus listed versions 17.0.10+7-117.0.10+7-1~deb11u117.0.10+7-1~deb12u117.0.10+7-217.0.10+7-3 Show 45 moreShow less 17.0.10~6ea-117.0.11+9-117.0.11+9-1~deb11u117.0.11+9-1~deb12u117.0.11~6ea-117.0.11~7ea-117.0.12+7-117.0.12+7-217.0.12+7-2~deb11u117.0.12+7-2~deb12u117.0.12~6ea-117.0.13+11-117.0.13+11-1~deb11u117.0.13+11-1~deb12u117.0.13+11-217.0.13+11-2~deb12u117.0.13~6ea-117.0.14+7-117.0.14+7-1~deb11u117.0.14+7-1~deb12u117.0.14~6ea-117.0.15+6-117.0.15+6-1~deb11u117.0.15+6-1~deb12u117.0.15~4ea-117.0.15~5ea-117.0.16+8-117.0.16+8-1~deb11u117.0.16+8-1~deb12u117.0.16~5ea-117.0.17+10-117.0.17+10-1~deb11u117.0.17+10-1~deb12u117.0.17~5ea-117.0.17~8ea-117.0.18+8-117.0.18+8-1~deb11u117.0.18+8-1~deb12u117.0.18~7ea-117.0.19+10-117.0.19+10-1~deb11u117.0.19+10-1~deb12u117.0.19+10-1~deb12u217.0.19~6ea-117.0.19~9ea-1	17.0.20.1+1-1~deb12u1
`openjdk-21` Debian:13	before 21.0.12.1+1-1~deb13u1, plus listed versions 21.0.10+7-121.0.10+7-1~deb13u121.0.10~4ea-121.0.10~6ea-121.0.11+10-1 Show 17 moreShow less 21.0.11+10-1~deb13u121.0.11+10-1~deb13u221.0.11~5ea-121.0.11~6ea-121.0.11~8ea-121.0.11~9ea-121.0.11~9ea-221.0.12+8-121.0.12+8-1~deb13u121.0.12+8-221.0.12~5ea-121.0.12~7ea-121.0.8+9-121.0.9+10-121.0.9+10-1~deb13u121.0.9~5ea-121.0.9~8ea-1	21.0.12.1+1-1~deb13u1
`openjdk-21` Debian:14	before 21.0.12.1+1-1, plus listed versions 21.0.10+7-121.0.10+7-1~deb13u121.0.10~4ea-121.0.10~6ea-121.0.11+10-1 Show 18 moreShow less 21.0.11+10-1~deb13u121.0.11+10-1~deb13u221.0.11~5ea-121.0.11~6ea-121.0.11~8ea-121.0.11~9ea-121.0.11~9ea-221.0.12+8-121.0.12+8-1~deb13u121.0.12+8-221.0.12.1+1-1~deb13u121.0.12~5ea-121.0.12~7ea-121.0.8+9-121.0.9+10-121.0.9+10-1~deb13u121.0.9~5ea-121.0.9~8ea-1	21.0.12.1+1-1
`openjdk-25` Debian:13	before 25.0.4.1+1-1~deb13u1, plus listed versions 25+36-125.0.1+8-125.0.1+8-1~deb13u125.0.1+8-225.0.1+8-3 Show 19 moreShow less 25.0.2+10-125.0.2+10-1~deb13u225.0.3+9-125.0.3+9-225.0.3+9-2~deb13u125.0.3~5ea-125.0.3~5ea-225.0.3~7ea-125.0.3~7ea-225.0.3~8ea-125.0.3~8ea-225.0.4+7-125.0.4+7-1~deb13u125.0.4+7-225.0.4~4ea-125.0.4~6ea-125~32ea-125~34ea-125~36ea-1	25.0.4.1+1-1~deb13u1
`openjdk-25` Debian:14	before 25.0.4.1+1-1, plus listed versions 25+36-125.0.1+8-125.0.1+8-1~deb13u125.0.1+8-225.0.1+8-3 Show 20 moreShow less 25.0.2+10-125.0.2+10-1~deb13u225.0.3+9-125.0.3+9-225.0.3+9-2~deb13u125.0.3~5ea-125.0.3~5ea-225.0.3~7ea-125.0.3~7ea-225.0.3~8ea-125.0.3~8ea-225.0.4+7-125.0.4+7-1~deb13u125.0.4+7-225.0.4.1+1-1~deb13u125.0.4~4ea-125.0.4~6ea-125~32ea-125~34ea-125~36ea-1	25.0.4.1+1-1
`java-21-openjdk` Mageia:10 From an advisory covering 11 CVEs	before 21.0.12.1.1-1.mga10	21.0.12.1.1-1.mga10
`java-17-openjdk` Mageia:9 From an advisory covering 11 CVEs	before 17.0.20.1.1-1.mga9	17.0.20.1.1-1.mga9
`openjdk-1.8.0` openEuler:24.03-LTS-SP1 From an advisory covering 19 CVEs	before java-1.8.0-openjdk-1.8.0.502.b07-0.oe2403sp1	java-1.8.0-openjdk-1.8.0.502.b07-0.oe2403sp1
`openjdk-1.8.0` openEuler:24.03-LTS-SP3 From an advisory covering 19 CVEs	before java-1.8.0-openjdk-1.8.0.502.b07-0.oe2403sp3	java-1.8.0-openjdk-1.8.0.502.b07-0.oe2403sp3
`openjdk-1.8.0` openEuler:24.03-LTS-SP4 From an advisory covering 8 CVEs	before java-1.8.0-openjdk-1.8.0.502.b07-1.oe2403sp4	java-1.8.0-openjdk-1.8.0.502.b07-1.oe2403sp4
`openjdk-1.8.0` openEuler:20.03-LTS-SP4 From an advisory covering 24 CVEs	before java-1.8.0-openjdk-1.8.0.502.b07-1.oe2003sp4	java-1.8.0-openjdk-1.8.0.502.b07-1.oe2003sp4
`openjdk-1.8.0` openEuler:22.03-LTS-SP4 From an advisory covering 19 CVEs	before java-1.8.0-openjdk-1.8.0.502.b07-0.oe2203sp4	java-1.8.0-openjdk-1.8.0.502.b07-0.oe2203sp4
`openjdk-17` openEuler:24.03-LTS-SP3 From an advisory covering 22 CVEs	before java-17-openjdk-17.0.20.8-4.oe2403sp3	java-17-openjdk-17.0.20.8-4.oe2403sp3
`openjdk-17` openEuler:24.03-LTS-SP4 From an advisory covering 22 CVEs	before java-17-openjdk-17.0.20.8-4.oe2403sp4	java-17-openjdk-17.0.20.8-4.oe2403sp4
`openjdk-17` openEuler:20.03-LTS-SP4 From an advisory covering 24 CVEs	before java-17-openjdk-17.0.20.8-4.oe2003sp4	java-17-openjdk-17.0.20.8-4.oe2003sp4
`openjdk-17` openEuler:22.03-LTS-SP4 From an advisory covering 22 CVEs	before java-17-openjdk-17.0.20.8-4.oe2203sp4	java-17-openjdk-17.0.20.8-4.oe2203sp4
`openjdk-17` openEuler:24.03-LTS-SP1 From an advisory covering 22 CVEs	before java-17-openjdk-17.0.20.8-4.oe2403sp1	java-17-openjdk-17.0.20.8-4.oe2403sp1
`openjdk-21` openEuler:22.03-LTS-SP4 From an advisory covering 27 CVEs	before java-21-openjdk-21.0.12.8-4.oe2203sp4	java-21-openjdk-21.0.12.8-4.oe2203sp4
`openjdk-21` openEuler:24.03-LTS-SP1 From an advisory covering 27 CVEs	before java-21-openjdk-21.0.12.8-4.oe2403sp1	java-21-openjdk-21.0.12.8-4.oe2403sp1
`openjdk-21` openEuler:24.03-LTS-SP4 From an advisory covering 27 CVEs	before java-21-openjdk-21.0.12.8-4.oe2403sp4	java-21-openjdk-21.0.12.8-4.oe2403sp4
`openjdk-25` openEuler:22.03-LTS-SP4 From an advisory covering 3 CVEs	before java-25-openjdk-25.0.4.7-1.oe2203sp4	java-25-openjdk-25.0.4.7-1.oe2203sp4
`openjdk-25` openEuler:24.03-LTS-SP4 From an advisory covering 3 CVEs	before java-25-openjdk-25.0.4.7-1.oe2403sp4	java-25-openjdk-25.0.4.7-1.oe2403sp4
`openjdk-21` openEuler:24.03-LTS-SP3 From an advisory covering 27 CVEs	before java-21-openjdk-21.0.12.8-4.oe2403sp3	java-21-openjdk-21.0.12.8-4.oe2403sp3
`openjdk-25` openEuler:24.03-LTS-SP3 From an advisory covering 3 CVEs	before java-25-openjdk-25.0.4.7-1.oe2403sp3	java-25-openjdk-25.0.4.7-1.oe2403sp3
`java-1.8.0-openjdk` Red Hat:rhel_els:7 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el7_9	1:1.8.0.504.b01-1.1.el7_9
`java-1.8.0-openjdk-debuginfo` Red Hat:rhel_els:7 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el7_9	1:1.8.0.504.b01-1.1.el7_9
`java-1.8.0-openjdk-devel` Red Hat:rhel_els:7 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el7_9	1:1.8.0.504.b01-1.1.el7_9
`java-1.8.0-openjdk-headless` Red Hat:rhel_els:7 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el7_9	1:1.8.0.504.b01-1.1.el7_9
`java-1.8.0-openjdk-accessibility` Red Hat:rhel_els:7 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el7_9	1:1.8.0.504.b01-1.1.el7_9
`java-1.8.0-openjdk-demo` Red Hat:rhel_els:7 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el7_9	1:1.8.0.504.b01-1.1.el7_9
`java-1.8.0-openjdk-javadoc` Red Hat:rhel_els:7 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el7_9	1:1.8.0.504.b01-1.1.el7_9
`java-1.8.0-openjdk-javadoc-zip` Red Hat:rhel_els:7 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el7_9	1:1.8.0.504.b01-1.1.el7_9
`java-1.8.0-openjdk-src` Red Hat:rhel_els:7 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el7_9	1:1.8.0.504.b01-1.1.el7_9
`java-1.8.0-openjdk` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-accessibility` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-demo` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-demo-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-devel` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-devel-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-headless` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-headless-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-javadoc` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-javadoc-zip` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-src` Red Hat:enterprise_linux:8::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk` Red Hat:rhel_aus:8.4::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-accessibility` Red Hat:rhel_aus:8.4::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-debuginfo` Red Hat:rhel_aus:8.4::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-debugsource` Red Hat:rhel_aus:8.4::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-demo` Red Hat:rhel_aus:8.4::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-demo-debuginfo` Red Hat:rhel_aus:8.4::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-devel` Red Hat:rhel_aus:8.4::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-devel-debuginfo` Red Hat:rhel_aus:8.4::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-headless` Red Hat:rhel_aus:8.4::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-headless-debuginfo` Red Hat:rhel_aus:8.4::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-javadoc` Red Hat:rhel_aus:8.4::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-javadoc-zip` Red Hat:rhel_aus:8.4::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-src` Red Hat:rhel_aus:8.4::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk` Red Hat:rhel_eus_long_life:8.4::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk-accessibility` Red Hat:rhel_eus_long_life:8.4::appstream From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8	1:1.8.0.504.b01-1.1.el8
`java-1.8.0-openjdk` Rocky Linux:8 From an advisory covering 3 CVEs	before 1:1.8.0.504.b01-1.1.el8_10	1:1.8.0.504.b01-1.1.el8_10
`java-17-openjdk` Rocky Linux:8 From an advisory covering 3 CVEs	before 1:17.0.20.1.1-1.1.el8_10	1:17.0.20.1.1-1.1.el8_10
`java-21-openjdk` Rocky Linux:8 From an advisory covering 3 CVEs	before 1:21.0.12.1.1-1.1.el8_10	1:21.0.12.1.1-1.1.el8_10
`java-25-openjdk` Rocky Linux:10 From an advisory covering 4 CVEs	before 1:25.0.4.1.1-1.1.el10_2	1:25.0.4.1.1-1.1.el10_2
`java-25-openjdk` SUSE:Linux Enterprise Server 16.0 From an advisory covering 4 CVEs	before 25.0.4.1-160000.1.1	25.0.4.1-160000.1.1
`java-25-openjdk` SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 4 CVEs	before 25.0.4.1-160000.1.1	25.0.4.1-160000.1.1
`java-17-openjdk` SUSE:Linux Enterprise Server 16.0 From an advisory covering 3 CVEs	before 17.0.20.1-160000.1.1	17.0.20.1-160000.1.1
`java-17-openjdk` SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 3 CVEs	before 17.0.20.1-160000.1.1	17.0.20.1-160000.1.1
`java-21-openjdk` SUSE:Linux Enterprise Server 16.0 From an advisory covering 3 CVEs	before 21.0.12.1-160000.1.1	21.0.12.1-160000.1.1
`java-21-openjdk` SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 3 CVEs	before 21.0.12.1-160000.1.1	21.0.12.1-160000.1.1
`java-1_8_0-openjdk` SUSE:Linux Enterprise Module for Legacy 15 SP7 From an advisory covering 3 CVEs	before 1.8.0.504-150000.3.126.1	1.8.0.504-150000.3.126.1
`java-1_8_0-openjdk` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 3 CVEs	before 1.8.0.504-150000.3.126.1	1.8.0.504-150000.3.126.1
`java-1_8_0-openjdk` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 3 CVEs	before 1.8.0.504-150000.3.126.1	1.8.0.504-150000.3.126.1
`java-1_8_0-openjdk` SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 3 CVEs	before 1.8.0.504-150000.3.126.1	1.8.0.504-150000.3.126.1
`java-1_8_0-openjdk` SUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 3 CVEs	before 1.8.0.504-150000.3.126.1	1.8.0.504-150000.3.126.1
`java-1_8_0-openjdk` SUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 3 CVEs	before 1.8.0.504-150000.3.126.1	1.8.0.504-150000.3.126.1
`java-1_8_0-openjdk` SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 3 CVEs	before 1.8.0.504-150000.3.126.1	1.8.0.504-150000.3.126.1
`java-1_8_0-openjdk` SUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 3 CVEs	before 1.8.0.504-150000.3.126.1	1.8.0.504-150000.3.126.1
`java-1_8_0-openjdk` SUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 3 CVEs	before 1.8.0.504-150000.3.126.1	1.8.0.504-150000.3.126.1
`java-25-openjdk` SUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 4 CVEs	before 25.0.4.1-150700.15.16.1	25.0.4.1-150700.15.16.1
`java-17-openjdk` SUSE:Linux Enterprise Module for Legacy 15 SP7 From an advisory covering 3 CVEs	before 17.0.20.1-150400.3.72.1	17.0.20.1-150400.3.72.1
`java-17-openjdk` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 3 CVEs	before 17.0.20.1-150400.3.72.1	17.0.20.1-150400.3.72.1
`java-17-openjdk` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 3 CVEs	before 17.0.20.1-150400.3.72.1	17.0.20.1-150400.3.72.1
`java-17-openjdk` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 3 CVEs	before 17.0.20.1-150400.3.72.1	17.0.20.1-150400.3.72.1
`java-17-openjdk` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 3 CVEs	before 17.0.20.1-150400.3.72.1	17.0.20.1-150400.3.72.1
`java-17-openjdk` SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 3 CVEs	before 17.0.20.1-150400.3.72.1	17.0.20.1-150400.3.72.1
`java-17-openjdk` SUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 3 CVEs	before 17.0.20.1-150400.3.72.1	17.0.20.1-150400.3.72.1
`java-17-openjdk` SUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 3 CVEs	before 17.0.20.1-150400.3.72.1	17.0.20.1-150400.3.72.1
`java-17-openjdk` SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 3 CVEs	before 17.0.20.1-150400.3.72.1	17.0.20.1-150400.3.72.1
`java-17-openjdk` SUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 3 CVEs	before 17.0.20.1-150400.3.72.1	17.0.20.1-150400.3.72.1
`java-17-openjdk` SUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 3 CVEs	before 17.0.20.1-150400.3.72.1	17.0.20.1-150400.3.72.1
`java-21-openjdk` SUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 3 CVEs	before 21.0.12.1-150600.3.32.1	21.0.12.1-150600.3.32.1
`java-21-openjdk` SUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 3 CVEs	before 21.0.12.1-150600.3.32.1	21.0.12.1-150600.3.32.1
`java-21-openjdk` SUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 3 CVEs	before 21.0.12.1-150600.3.32.1	21.0.12.1-150600.3.32.1
`java-1_8_0-openjdk` SUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 3 CVEs	before 1.8.0.504-27.134.1	1.8.0.504-27.134.1
`java-1_8_0-openjdk` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 3 CVEs	before 1.8.0.504-27.134.1	1.8.0.504-27.134.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 8 CVEs	before 1.8.0_sr8.71-30.156.1	1.8.0_sr8.71-30.156.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 8 CVEs	before 1.8.0_sr8.71-30.156.1	1.8.0_sr8.71-30.156.1
`java-1_8_0-ibm` SUSE:Linux Enterprise Module for Legacy 15 SP7 From an advisory covering 8 CVEs	before 1.8.0_sr8.71-150000.3.125.1	1.8.0_sr8.71-150000.3.125.1
`java-1_8_0-ibm` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 8 CVEs	before 1.8.0_sr8.71-150000.3.125.1	1.8.0_sr8.71-150000.3.125.1
`java-1_8_0-ibm` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 8 CVEs	before 1.8.0_sr8.71-150000.3.125.1	1.8.0_sr8.71-150000.3.125.1
`openjdk-8` Ubuntu:Pro:16.04:LTS	before 8u504-ga-1ubuntu1~16.04.3, plus listed versions 8u66-b01-58u72-b05-1ubuntu18u72-b05-58u72-b05-68u72-b15-1 Show 45 moreShow less 8u72-b15-2ubuntu18u72-b15-2ubuntu38u72-b15-3ubuntu18u77-b03-1ubuntu28u77-b03-3ubuntu18u77-b03-3ubuntu28u77-b03-3ubuntu38u91-b14-0ubuntu4~16.04.18u91-b14-3ubuntu1~16.04.18u111-b14-2ubuntu0.16.04.28u121-b13-0ubuntu1.16.04.28u131-b11-0ubuntu1.16.04.28u131-b11-2ubuntu1.16.04.28u131-b11-2ubuntu1.16.04.38u151-b12-0ubuntu0.16.04.28u162-b12-0ubuntu0.16.04.28u171-b11-0ubuntu0.16.04.18u181-b13-0ubuntu0.16.04.18u181-b13-1ubuntu0.16.04.18u191-b12-0ubuntu0.16.04.18u191-b12-2ubuntu0.16.04.18u212-b03-0ubuntu1.16.04.18u222-b10-1ubuntu1~16.04.18u232-b09-0ubuntu1~16.04.18u242-b08-0ubuntu3~16.048u252-b09-1~16.048u265-b01-0ubuntu2~16.048u272-b10-0ubuntu1~16.048u275-b01-0ubuntu1~16.048u282-b08-0ubuntu1~16.048u292-b10-0ubuntu1~16.04.18u312-b07-0ubuntu1~16.048u342-b07-0ubuntu1~16.048u352-ga-1~16.048u362-ga-0ubuntu1~16.04.18u372-ga~us1-0ubuntu1~16.048u382-ga-1~16.04.18u392-ga-1~16.048u432-ga~us1-0ubuntu2~16.04.48u442-b06~us1-0ubuntu1~16.048u452-ga~us1-0ubuntu1~16.04.18u462-ga~us1-0ubuntu2~16.04.28u472-ga-1~16.048u482-ga~us1-0ubuntu1~16.048u492-ga~us2-0ubuntu1~16.04.1	8u504-ga-1ubuntu1~16.04.3
`openjdk-9` Ubuntu:16.04:LTS	All versions, plus listed versions 9~b88-19~b101-2ubuntu29~b102-19~b113-0ubuntu19~b114-0ubuntu1	None known
`openjdk-lts` Ubuntu:Pro:18.04:LTS	before 11.0.32.1+1-1ubuntu1~18.04, plus listed versions 9.0.4+12-2ubuntu49.0.4+12-4ubuntu110~46-4ubuntu110~46-5ubuntu110.0.1+10-1ubuntu2 Show 37 moreShow less 10.0.1+10-3ubuntu110.0.2+13-1ubuntu0.18.04.110.0.2+13-1ubuntu0.18.04.210.0.2+13-1ubuntu0.18.04.310.0.2+13-1ubuntu0.18.04.411.0.2+9-3ubuntu1~18.04.311.0.3+7-1ubuntu2~18.04.111.0.4+11-1ubuntu2~18.04.311.0.5+10-0ubuntu1.1~18.0411.0.6+10-1ubuntu1~18.04.111.0.7+10-2ubuntu2~18.0411.0.8+10-0ubuntu1~18.04.111.0.9+11-0ubuntu1~18.04.111.0.9.1+1-0ubuntu1~18.0411.0.10+9-0ubuntu1~18.0411.0.11+9-0ubuntu2~18.0411.0.13+8-0ubuntu1~18.0411.0.14+9-0ubuntu2~18.0411.0.14.1+1-0ubuntu1~18.0411.0.15+10-0ubuntu0.18.04.111.0.16+8-0ubuntu1~18.0411.0.17+8-1ubuntu2~18.0411.0.18+10-0ubuntu1~18.04.111.0.19+7~us1-0ubuntu1~18.04.111.0.20+8-1ubuntu1~18.0411.0.20.1+1-0ubuntu1~18.0411.0.21+9-0ubuntu1~18.0411.0.22+7-0ubuntu2~18.04.111.0.23+9-1ubuntu1~18.04.111.0.25+9-1ubuntu1~18.0411.0.26+4-1ubuntu1~18.0411.0.27+6~us1-0ubuntu1~18.0411.0.28+6-1ubuntu1~18.04.111.0.29+7-1ubuntu1~18.0411.0.30+7-1ubuntu1~18.0411.0.31+11-1ubuntu1~18.04.211.0.32+9-1ubuntu1~18.04	11.0.32.1+1-1ubuntu1~18.04
`openjdk-17` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 17+35-1~18.0417.0.1+12-1~18.0417.0.2+8-1~18.0417.0.3+7-0ubuntu0.18.04.117.0.4+8-1~18.04 Show 17 moreShow less 17.0.5+8-2ubuntu1~18.0417.0.6+10-0ubuntu1~18.04.117.0.7+7~us1-0ubuntu1~18.0417.0.8+7-1~18.0417.0.8.1+1~us1-0ubuntu1~18.0417.0.9+9-1~18.0417.0.10+7-1~18.04.117.0.11+9-1~18.04.117.0.13+11-2ubuntu1~18.04.217.0.14+7-1~18.0417.0.15+6~us1-0ubuntu1~18.0417.0.16+8~us1-0ubuntu1~18.04.117.0.17+10-1~18.0417.0.18+8-1~18.0417.0.19+10-1~18.04.217.0.20+8-1~18.0417.0.20.1+1-1~18.04	None known
`openjdk-8` Ubuntu:Pro:18.04:LTS	before 8u504-ga-1ubuntu1~18.04.3, plus listed versions 8u144-b01-28u151-b12-18u162-b12-18u171-b11-0ubuntu0.18.04.18u181-b13-0ubuntu0.18.04.1 Show 31 moreShow less 8u181-b13-1ubuntu0.18.04.18u191-b12-0ubuntu0.18.04.18u191-b12-2ubuntu0.18.04.18u212-b03-0ubuntu1.18.04.18u222-b10-1ubuntu1~18.04.18u232-b09-0ubuntu1~18.04.18u242-b08-0ubuntu3~18.048u252-b09-1~18.048u265-b01-0ubuntu2~18.048u272-b10-0ubuntu1~18.048u275-b01-0ubuntu1~18.048u282-b08-0ubuntu1~18.048u292-b10-0ubuntu1~18.048u312-b07-0ubuntu1~18.048u342-b07-0ubuntu1~18.048u352-ga-1~18.048u362-ga-0ubuntu1~18.04.18u372-ga~us1-0ubuntu1~18.048u382-ga-1~18.04.18u392-ga-1~18.048u402-ga-2ubuntu1~18.048u412-ga-1~18.04.18u422-b05-1~18.048u432-ga~us1-0ubuntu2~18.048u442-b06~us1-0ubuntu1~18.048u452-ga~us1-0ubuntu1~18.048u462-ga~us1-0ubuntu2~18.04.28u472-ga-1~18.048u482-ga~us1-0ubuntu1~18.048u492-ga~us2-0ubuntu1~18.04.18u502-ga~us1-0ubuntu1~18.04	8u504-ga-1ubuntu1~18.04.3
`openjdk-lts` Ubuntu:Pro:20.04:LTS	before 11.0.32.1+1-1ubuntu1~20.04, plus listed versions 11.0.5+10-0ubuntu111.0.5+10-2ubuntu111.0.6+10-1ubuntu111.0.6+10-2ubuntu211.0.7+9-1ubuntu1 Show 29 moreShow less 11.0.7+10-2ubuntu111.0.7+10-3ubuntu111.0.8+10-0ubuntu1~20.0411.0.9+11-0ubuntu1~20.0411.0.9.1+1-0ubuntu1~20.0411.0.10+9-0ubuntu1~20.0411.0.11+9-0ubuntu2~20.0411.0.13+8-0ubuntu1~20.0411.0.14+9-0ubuntu2~20.0411.0.14.1+1-0ubuntu1~20.0411.0.15+10-0ubuntu0.20.04.111.0.16+8-0ubuntu1~20.0411.0.17+8-1ubuntu2~20.0411.0.18+10-0ubuntu1~20.04.111.0.19+7~us1-0ubuntu1~20.04.111.0.20+8-1ubuntu1~20.0411.0.20.1+1-0ubuntu1~20.0411.0.21+9-0ubuntu1~20.0411.0.22+7-0ubuntu2~20.04.111.0.23+9-1ubuntu1~20.04.211.0.24+8-1ubuntu3~20.0411.0.25+9-1ubuntu1~20.0411.0.26+4-1ubuntu1~20.0411.0.27+6~us1-0ubuntu1~20.0411.0.28+6-1ubuntu1~20.04.111.0.29+7-1ubuntu1~20.0411.0.30+7-1ubuntu1~20.0411.0.31+11-1ubuntu1~20.04.211.0.32+9-1ubuntu1~20.04	11.0.32.1+1-1ubuntu1~20.04
`openjdk-13` Ubuntu:20.04:LTS	All versions, plus listed versions 13+33-113.0.1+9-213.0.2+8-113.0.2+8-213.0.3+3-1ubuntu213.0.4+8-1~20.0413.0.7+5-0ubuntu1~20.04	None known
`openjdk-16` Ubuntu:20.04:LTS	All versions, plus listed versions 16.0.1+9-1~20.04	None known
`openjdk-17` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 17+35-1~20.0417.0.1+12-1~20.0417.0.2+8-1~20.0417.0.3+7-0ubuntu0.20.04.117.0.4+8-1~20.04 Show 18 moreShow less 17.0.5+8-2ubuntu1~20.0417.0.6+10-0ubuntu1~20.04.117.0.7+7~us1-0ubuntu1~20.0417.0.8+7-1~20.04.217.0.8.1+1~us1-0ubuntu1~20.0417.0.9+9-1~20.0417.0.10+7-1~20.04.117.0.11+9-1~20.04.217.0.12+7-1ubuntu2~20.0417.0.13+11-2ubuntu1~20.0417.0.14+7-1~20.0417.0.15+6~us1-0ubuntu1~20.0417.0.16+8~us1-0ubuntu1~20.04.617.0.17+10-1~20.0417.0.18+8-1~20.0417.0.19+10-1~20.04.217.0.20+8-1~20.0417.0.20.1+1-1~20.04	None known
`openjdk-21` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 21.0.1+12-2~20.04.121.0.2+13-1~20.04.121.0.3+9-1ubuntu1~20.04.121.0.4+7-1ubuntu2~20.0421.0.5+11-1ubuntu1~20.04 Show 8 moreShow less 21.0.6+7-1~20.04.121.0.7+6~us1-0ubuntu1~20.0421.0.8+9~us1-0ubuntu1~20.04.121.0.9+10-1~20.0421.0.10+7-1~20.0421.0.11+10-1~20.04.221.0.12+8-1~20.0421.0.12.1+1-1~20.04.4	None known
`openjdk-8` Ubuntu:Pro:20.04:LTS	before 8u504-ga-1ubuntu1~20.04.3, plus listed versions 8u232-b09-0ubuntu18u232-b09-18u242-b04-18u242-b08-0ubuntu38u252-b07-1 Show 24 moreShow less 8u252-b09-1ubuntu18u265-b01-0ubuntu2~20.048u272-b10-0ubuntu1~20.048u275-b01-0ubuntu1~20.048u282-b08-0ubuntu1~20.048u292-b10-0ubuntu1~20.048u312-b07-0ubuntu1~20.048u342-b07-0ubuntu1~20.048u352-ga-1~20.048u362-ga-0ubuntu1~20.04.18u372-ga~us1-0ubuntu1~20.048u382-ga-1~20.04.18u392-ga-1~20.048u402-ga-2ubuntu1~20.048u412-ga-1~20.04.18u422-b05-1~20.048u432-ga~us1-0ubuntu2~20.048u442-b06~us1-0ubuntu1~20.048u452-ga~us1-0ubuntu1~20.048u462-ga~us1-0ubuntu2~20.04.28u472-ga-1~20.048u482-ga~us1-0ubuntu1~20.048u492-ga~us2-0ubuntu1~20.04.18u502-ga~us1-0ubuntu1~20.04	8u504-ga-1ubuntu1~20.04.3
`openjdk-17` Ubuntu:22.04:LTS	All versions, plus listed versions 17+35-117.0.1+12-117.0.2+8-117.0.3+7-0ubuntu0.22.04.117.0.4+8-1~22.04 Show 18 moreShow less 17.0.5+8-2ubuntu1~22.0417.0.6+10-0ubuntu1~22.0417.0.7+7~us1-0ubuntu1~22.04.217.0.8+7-1~22.0417.0.8.1+1~us1-0ubuntu1~22.0417.0.9+9-1~22.0417.0.10+7-1~22.04.117.0.11+9-1~22.04.117.0.12+7-1ubuntu2~22.0417.0.13+11-2ubuntu1~22.0417.0.14+7-1~22.04.117.0.15+6~us1-0ubuntu1~22.0417.0.16+8~us1-0ubuntu1~22.04.117.0.17+10-1~22.0417.0.18+8-1~22.04.117.0.19+10-1~22.04.217.0.20+8-1~22.0417.0.20.1+1-1~22.04	None known
`openjdk-18` Ubuntu:22.04:LTS	All versions, plus listed versions 18~15ea-418~20ea-118~32ea-118~36ea-118.0.2+9-2~22.04	None known
`openjdk-21` Ubuntu:22.04:LTS	All versions, plus listed versions 21.0.1+12-2~22.0421.0.2+13-1~22.04.121.0.3+9-1ubuntu1~22.04.121.0.4+7-1ubuntu2~22.0421.0.5+11-1ubuntu1~22.04 Show 8 moreShow less 21.0.6+7-1~22.04.121.0.7+6~us1-0ubuntu1~22.0421.0.8+9~us1-0ubuntu1~22.04.121.0.9+10-1~22.0421.0.10+7-1~22.0421.0.11+10-1~22.04.221.0.12+8-1~22.0421.0.12.1+1-1~22.04.4	None known
`openjdk-25` Ubuntu:22.04:LTS	before 25.0.4.1+1-1~22.04.4, plus listed versions 25+36-1~22.04.225.0.1+8-1~22.0425.0.2+10-1~22.0425.0.3+9-2~22.04.225.0.4+7-1~22.04	25.0.4.1+1-1~22.04.4
`openjdk-8` Ubuntu:22.04:LTS	before 8u504-ga-1ubuntu1~22.04.3, plus listed versions 8u302-b08-0ubuntu28u312-b07-0ubuntu18u342-b07-0ubuntu1~22.048u352-ga-1~22.048u362-ga-0ubuntu1~22.04 Show 14 moreShow less 8u372-ga~us1-0ubuntu1~22.048u382-ga-1~22.04.18u392-ga-1~22.048u402-ga-2ubuntu1~22.048u412-ga-1~22.04.18u422-b05-1~22.048u432-ga~us1-0ubuntu2~22.048u442-b06~us1-0ubuntu1~22.048u452-ga~us1-0ubuntu1~22.048u462-ga~us1-0ubuntu2~22.04.28u472-ga-1~22.048u482-ga~us1-0ubuntu1~22.048u492-ga~us2-0ubuntu1~22.04.18u502-ga~us1-0ubuntu1~22.04	8u504-ga-1ubuntu1~22.04.3
`openjdk-lts` Ubuntu:22.04:LTS	before 11.0.32.1+1-1ubuntu1~22.04, plus listed versions 11.0.12+7-0ubuntu311.0.13+8-0ubuntu111.0.14+9-0ubuntu211.0.14.1+1-0ubuntu111.0.15+10-0ubuntu0.22.04.1 Show 18 moreShow less 11.0.16+8-0ubuntu1~22.0411.0.17+8-1ubuntu2~22.0411.0.18+10-0ubuntu1~22.0411.0.19+7~us1-0ubuntu1~22.04.111.0.20+8-1ubuntu1~22.0411.0.20.1+1-0ubuntu1~22.0411.0.21+9-0ubuntu1~22.0411.0.22+7-0ubuntu2~22.04.111.0.23+9-1ubuntu1~22.04.111.0.24+8-1ubuntu3~22.0411.0.25+9-1ubuntu1~22.0411.0.26+4-1ubuntu1~22.0411.0.27+6~us1-0ubuntu1~22.0411.0.28+6-1ubuntu1~22.04.111.0.29+7-1ubuntu1~22.0411.0.30+7-1ubuntu1~22.0411.0.31+11-1ubuntu1~22.04.211.0.32+9-1ubuntu1~22.04	11.0.32.1+1-1ubuntu1~22.04
`openjdk-17` Ubuntu:24.04:LTS	All versions, plus listed versions 17.0.9~6ea-117.0.9+9-117.0.9+9-217.0.10~6ea-117.0.10+7-1 Show 13 moreShow less 17.0.11~7ea-117.0.11~7ea-1build117.0.11+9-117.0.12+7-1ubuntu2~24.0417.0.13+11-2ubuntu1~24.0417.0.14+7-1~24.0417.0.15+6~us1-0ubuntu1~24.0417.0.16+8~us1-0ubuntu1~24.04.117.0.17+10-1~24.0417.0.18+8-1~24.04.117.0.19+10-1~24.04.217.0.20+8-1~24.0417.0.20.1+1-1~24.04	None known
`openjdk-21` Ubuntu:24.04:LTS	All versions, plus listed versions 21+35-121.0.1+12-221.0.1+12-321.0.2+13-121.0.2+13-2 Show 15 moreShow less 21.0.3~7ea-121.0.3~7ea-1build121.0.3~7ea-1build221.0.3+9-121.0.3+9-1ubuntu121.0.4+7-1ubuntu2~24.0421.0.5+11-1ubuntu1~24.0421.0.6+7-1~24.04.121.0.7+6~us1-0ubuntu1~24.0421.0.8+9~us1-0ubuntu1~24.04.121.0.9+10-1~24.0421.0.10+7-1~24.0421.0.11+10-1~24.04.221.0.12+8-1~24.0421.0.12.1+1-1~24.04.4	None known
`openjdk-25` Ubuntu:24.04:LTS	before 25.0.4.1+1-1~24.04.4, plus listed versions 25+36-1~24.04.225.0.1+8-1~24.0425.0.2+10-1~24.0425.0.3+9-2~24.04.225.0.4+7-1~24.04	25.0.4.1+1-1~24.04.4
`openjdk-8` Ubuntu:24.04:LTS	before 8u504-ga-1ubuntu1~24.04.3, plus listed versions 8u382-ga-1ubuntu18u392-ga-18u402-ga-18u402-ga-28u402-ga-2ubuntu1 Show 13 moreShow less 8u402-ga-2ubuntu68u402-ga-2ubuntu78u402-ga-8build18u412-ga-1~24.04.28u422-b05-1~24.048u432-ga~us1-0ubuntu2~24.048u442-b06~us1-0ubuntu1~24.048u452-ga~us1-0ubuntu1~24.048u462-ga~us1-0ubuntu2~24.04.28u472-ga-1~24.048u482-ga~us1-0ubuntu1~24.048u492-ga~us2-0ubuntu1~24.04.18u502-ga~us1-0ubuntu1~24.04	8u504-ga-1ubuntu1~24.04.3
`openjdk-lts` Ubuntu:24.04:LTS	before 11.0.32.1+1-1ubuntu1~24.04, plus listed versions 11.0.20+8-1ubuntu111.0.21+9-0ubuntu111.0.22+7-0ubuntu211.0.23~7ea-1ubuntu111.0.23~7ea-1ubuntu2 Show 10 moreShow less 11.0.23+9-1ubuntu111.0.24+8-1ubuntu3~24.04.111.0.25+9-1ubuntu1~24.0411.0.26+4-1ubuntu1~24.0411.0.27+6~us1-0ubuntu1~24.0411.0.28+6-1ubuntu1~24.04.111.0.29+7-1ubuntu1~24.0411.0.30+7-1ubuntu1~24.0411.0.31+11-1ubuntu1~24.04.211.0.32+9-1ubuntu1~24.04	11.0.32.1+1-1ubuntu1~24.04
`openjdk-17` Ubuntu:26.10	All versions, plus listed versions 17.0.18+8-117.0.19+10-117.0.20~5ea-117.0.20+8-117.0.20.1+1-117.0.21~6ea-1	None known
`openjdk-17-crac` Ubuntu:26.10	All versions, plus listed versions 17.0.18+8-0ubuntu117.0.19+10-0ubuntu117.0.20+8-0ubuntu1	None known
`openjdk-21` Ubuntu:26.10	All versions, plus listed versions 21.0.11~8ea-121.0.11+10-121.0.12~5ea-121.0.12+8-121.0.12.1+1-1	None known
`openjdk-21-crac` Ubuntu:26.10	All versions, plus listed versions 21.0.10+7-0ubuntu121.0.11+10-0ubuntu121.0.12+8-0ubuntu1	None known
`openjdk-17` Ubuntu:26.04:LTS	All versions, plus listed versions 17.0.17~8ea-117.0.17+10-117.0.18~7ea-117.0.18+8-117.0.19+10-1~26.04.217.0.20+8-1~26.0417.0.20.1+1-1~26.04	None known
`openjdk-17-crac` Ubuntu:26.04:LTS	All versions, plus listed versions 17.0.16+8-0ubuntu117.0.17+10-0ubuntu117.0.18+8-0ubuntu117.0.19+10-0ubuntu1~26.04.117.0.20+8-0ubuntu1~26.04	None known
`openjdk-21` Ubuntu:26.04:LTS	All versions, plus listed versions 21.0.9~8ea-121.0.9+10-121.0.10~4ea-121.0.10~6ea-121.0.10+7-1 Show 5 moreShow less 21.0.11~5ea-121.0.11~8ea-121.0.11+10-1~26.04.221.0.12+8-1~26.0421.0.12.1+1-1~26.04.4	None known
`openjdk-21-crac` Ubuntu:26.04:LTS	All versions, plus listed versions 21.0.8+9-0ubuntu121.0.9+10-0ubuntu121.0.10+7-0ubuntu121.0.11+10-0ubuntu1~26.04.121.0.12+8-0ubuntu1~26.04	None known
`openjdk-25` Ubuntu:26.04:LTS	before 25.0.4.1+1-1~26.04.4, plus listed versions 25+36-125.0.1+8-125.0.1+8-225.0.1+8-325.0.2+10-1 Show 4 moreShow less 25.0.3~5ea-225.0.3~7ea-225.0.3+9-2~26.04.225.0.4+7-1~26.04	25.0.4.1+1-1~26.04.4
`openjdk-8` Ubuntu:26.04:LTS	before 8u504-ga-1ubuntu1~26.04.3, plus listed versions 8u462-ga-18u472-ga~us1-0ubuntu18u472-ga-18u482-ga~us1-0ubuntu18u492-ga~us2-0ubuntu1~26.04.18u502-ga~us1-0ubuntu1~26.04	8u504-ga-1ubuntu1~26.04.3
`openjdk-lts` Ubuntu:26.04:LTS	before 11.0.32.1+1-1ubuntu1~26.04, plus listed versions 11.0.28+6-1ubuntu111.0.29+7-1ubuntu111.0.30+7-1ubuntu111.0.31+11-1ubuntu1~26.04.211.0.32+9-1ubuntu1~26.04	11.0.32.1+1-1ubuntu1~26.04
`openjdk-25` Ubuntu:22.04:LTS From an advisory covering 4 CVEs	before 25.0.4.1+1-1~22.04.4, plus listed versions 25+36-1~22.04.225.0.1+8-1~22.0425.0.2+10-1~22.0425.0.3+9-2~22.04.225.0.4+7-1~22.04	25.0.4.1+1-1~22.04.4
`openjdk-25` Ubuntu:24.04:LTS From an advisory covering 4 CVEs	before 25.0.4.1+1-1~24.04.4, plus listed versions 25+36-1~24.04.225.0.1+8-1~24.0425.0.2+10-1~24.0425.0.3+9-2~24.04.225.0.4+7-1~24.04	25.0.4.1+1-1~24.04.4
`openjdk-25` Ubuntu:26.04:LTS From an advisory covering 4 CVEs	before 25.0.4.1+1-1~26.04.4, plus listed versions 25+36-125.0.1+8-125.0.1+8-225.0.1+8-325.0.2+10-1 Show 4 moreShow less 25.0.3~5ea-225.0.3~7ea-225.0.3+9-2~26.04.225.0.4+7-1~26.04	25.0.4.1+1-1~26.04.4
`openjdk-8` Ubuntu:Pro:16.04:LTS From an advisory covering 3 CVEs	before 8u504-ga-1ubuntu1~16.04.3, plus listed versions 8u66-b01-58u72-b05-1ubuntu18u72-b05-58u72-b05-68u72-b15-1 Show 45 moreShow less 8u72-b15-2ubuntu18u72-b15-2ubuntu38u72-b15-3ubuntu18u77-b03-1ubuntu28u77-b03-3ubuntu18u77-b03-3ubuntu28u77-b03-3ubuntu38u91-b14-0ubuntu4~16.04.18u91-b14-3ubuntu1~16.04.18u111-b14-2ubuntu0.16.04.28u121-b13-0ubuntu1.16.04.28u131-b11-0ubuntu1.16.04.28u131-b11-2ubuntu1.16.04.28u131-b11-2ubuntu1.16.04.38u151-b12-0ubuntu0.16.04.28u162-b12-0ubuntu0.16.04.28u171-b11-0ubuntu0.16.04.18u181-b13-0ubuntu0.16.04.18u181-b13-1ubuntu0.16.04.18u191-b12-0ubuntu0.16.04.18u191-b12-2ubuntu0.16.04.18u212-b03-0ubuntu1.16.04.18u222-b10-1ubuntu1~16.04.18u232-b09-0ubuntu1~16.04.18u242-b08-0ubuntu3~16.048u252-b09-1~16.048u265-b01-0ubuntu2~16.048u272-b10-0ubuntu1~16.048u275-b01-0ubuntu1~16.048u282-b08-0ubuntu1~16.048u292-b10-0ubuntu1~16.04.18u312-b07-0ubuntu1~16.048u342-b07-0ubuntu1~16.048u352-ga-1~16.048u362-ga-0ubuntu1~16.04.18u372-ga~us1-0ubuntu1~16.048u382-ga-1~16.04.18u392-ga-1~16.048u432-ga~us1-0ubuntu2~16.04.48u442-b06~us1-0ubuntu1~16.048u452-ga~us1-0ubuntu1~16.04.18u462-ga~us1-0ubuntu2~16.04.28u472-ga-1~16.048u482-ga~us1-0ubuntu1~16.048u492-ga~us2-0ubuntu1~16.04.1	8u504-ga-1ubuntu1~16.04.3
`java-11-openjdk` openSUSE:Tumbleweed From an advisory covering 3 CVEs	before 11.0.32.1-1.1	11.0.32.1-1.1
`java-17-openjdk` openSUSE:Tumbleweed From an advisory covering 3 CVEs	before 17.0.20.1-1.1	17.0.20.1-1.1
`java-21-openjdk` openSUSE:Tumbleweed From an advisory covering 3 CVEs	before 21.0.12.1-1.1	21.0.12.1-1.1
`java-25-openjdk` openSUSE:Tumbleweed From an advisory covering 4 CVEs	before 25.0.4.1-1.1	25.0.4.1-1.1
`java-1_8_0-openjdk` openSUSE:Tumbleweed From an advisory covering 3 CVEs	before 1.8.0.504-1.1	1.8.0.504-1.1
`java-25-openjdk` openSUSE:Leap 16.0 From an advisory covering 4 CVEs	before 25.0.4.1-160000.1.1	25.0.4.1-160000.1.1
`java-17-openjdk` openSUSE:Leap 16.0 From an advisory covering 3 CVEs	before 17.0.20.1-160000.1.1	17.0.20.1-160000.1.1
`java-21-openjdk` openSUSE:Leap 16.0 From an advisory covering 3 CVEs	before 21.0.12.1-160000.1.1	21.0.12.1-160000.1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected	OSV
Nov 2, 2026	affected, aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-60589 is a low vulnerability (CVSS 3.7) in Oracle Corporation Java Se, Oracle Graalvm For Jdk, Oracle Graalvm Enterprise Edition, published August 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. Fixed in openjdk-nik-23-17 23.0.13.1-r0.

References

Show 176 moreShow less

This page doesn't list everything

Left out here: 1,264 package rows, 28 versions and the rest of 14 source descriptions. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 26 source records.