CVE-2025-50059

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

The OpenJDK runtime environment.

Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive(CVE-2025-28162)

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.(CVE-2025-28164)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).(CVE-2025-30749)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2025-30754)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies…

The OpenJDK runtime environment.

Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive(CVE-2025-28162)

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.(CVE-2025-28164)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).(CVE-2025-30749)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2025-30754)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies…

The OpenJDK runtime environment.

Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive(CVE-2025-28162)

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.(CVE-2025-28164)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).(CVE-2025-30749)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2025-30754)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies…

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).(CVE-2025-50059)

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).(CVE-2025-50059)

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).(CVE-2025-50059)

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).(CVE-2025-50059)

The OpenJDK runtime environment.

Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive(CVE-2025-28162)

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.(CVE-2025-28164)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).(CVE-2025-30749)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2025-30754)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies…

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).(CVE-2025-50059)

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

• JDK: Better Glyph drawing (CVE-2025-30749)
• JDK: Enhance TLS protocol support (CVE-2025-30754)
• JDK: Improve HTTP client header handling (CVE-2025-50059)
• JDK: Better Glyph drawing redux (CVE-2025-50106)

Bug Fix(es):

• In Rocky Linux 9 and Rocky Linux 10 systems, the default graphical display system is Wayland. The use of Wayland in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a screen capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire package, which the JDK can use to take screen captures in Wayland systems (Rocky Linux-102668, Rocky Linux-102669, Rocky Linux-102670, Rocky Linux-102672)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.

Security Fix(es):

• JDK: Better Glyph drawing (CVE-2025-30749)
• JDK: Enhance TLS protocol support (CVE-2025-30754)
• JDK: Improve HTTP client header handling (CVE-2025-50059)
• JDK: Better Glyph drawing redux (CVE-2025-50106)

Bug Fix(es):

• In Rocky Linux 9 and Rocky Linux 10 systems, the default graphical display system is Wayland. The use of Wayland in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a screen capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire package, which the JDK can use to take screen captures in Wayland systems (Rocky Linux-102683, Rocky Linux-102684, Rocky Linux-102685)
• On NUMA systems, the operating system can choose to migrate a task from one NUMA node to another. In the G1 garbage collector, G1AllocRegion objects are associated with NUMA nodes. The G1Allocator code assumes that obtaining the G1AllocRegion object for the current thread is sufficient, but OS scheduling can lead to arbitrary changes in the NUMA-to-thread association. This can cause crashes when the G1AllocRegion being used changes mid-operation. This update resolves this issue by always using the same NUMA node and associated G1AllocRegion object throughout an operation. (Rocky Linux-90307, Rocky Linux-90308, Rocky Linux-90311)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

• JDK: Better Glyph drawing (CVE-2025-30749)
• JDK: Enhance TLS protocol support (CVE-2025-30754)
• JDK: Improve HTTP client header handling (CVE-2025-50059)
• JDK: Better Glyph drawing redux (CVE-2025-50106)

Bug Fix(es):

• In AlmaLinuxand AlmaLinux systems, the default graphical display system is Wayland. The use of Wayland in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a screen capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire package, which the JDK can use to take screen captures in Wayland systems (AlmaLinux-102668, AlmaLinux-102669, AlmaLinux-102670, AlmaLinux-102672)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.

Security Fix(es):

• JDK: Better Glyph drawing (CVE-2025-30749)
• JDK: Enhance TLS protocol support (CVE-2025-30754)
• JDK: Improve HTTP client header handling (CVE-2025-50059)
• JDK: Better Glyph drawing redux (CVE-2025-50106)

Bug Fix(es):

• In AlmaLinuxand AlmaLinux systems, the default graphical display system is Wayland. The use of Wayland in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a screen capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire package, which the JDK can use to take screen captures in Wayland systems (AlmaLinux-102683, AlmaLinux-102684, AlmaLinux-102685)
• On NUMA systems, the operating system can choose to migrate a task from one NUMA node to another. In the G1 garbage collector, G1AllocRegion objects are associated with NUMA nodes. The G1Allocator code assumes that obtaining the G1AllocRegion object for the current thread is sufficient, but OS scheduling can lead to arbitrary changes in the NUMA-to-thread association. This can cause crashes when the G1AllocRegion being used changes mid-operation. This update resolves this issue by always using the same NUMA node and associated G1AllocRegion object throughout an operation. (AlmaLinux-90307, AlmaLinux-90308, AlmaLinux-90311)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

• Update to jdk-17.0.16+8
• CVE-2025-50106: fix 2D component vulnerability in Java SE allowing remote attackers to compromise the Java runtime via crafted input
• CVE-2025-30749: fix 2D rendering vulnerability in Java SE that could lead to application crash or remote code execution
• CVE-2025-30754: fix JSSE component vulnerability allowing unauthorized access to sensitive data over TLS connections
• CVE-2025-50059: fix Networking component vulnerability allowing unauthenticated remote attackers to access sensitive data in Java SE and GraalVM environments

• OpenJDK 11.0.28 release, build 6.
  • CVE-2025-30749: Java 2D heap corruption, code execution/DoS
  • CVE-2025-30754: JSSE TLS handshake flaw, weakened encryption
  • CVE-2025-30761: nashorn sandbox bypass, code execution
  • CVE-2025-50059: HTTP client header bug, data leak
  • CVE-2025-50106: Glyph rendering memory bug, crash/code exec
  • Release notes: https://mail.openjdk.org/pipermail/jdk-updates-dev/2025-July/045612.html

• OpenJDK 8u462 release
  • CVE-2025-30749: Java 2D heap corruption, code execution/DoS
  • CVE-2025-30754: JSSE TLS handshake flaw, weakened encryption
  • CVE-2025-30761: nashorn sandbox bypass, code execution
  • CVE-2025-50059: HTTP client header bug, data leak
  • CVE-2025-50106: Glyph rendering memory bug, crash/code exec
  • Release notes: https://mail.openjdk.org/pipermail/jdk8u-dev/2025-July/020263.html

• OpenJDK 8u462 release
  • CVE-2025-30749: Java 2D heap corruption, code execution/DoS
  • CVE-2025-30754: JSSE TLS handshake flaw, weakened encryption
  • CVE-2025-30761: nashorn sandbox bypass, code execution
  • CVE-2025-50059: HTTP client header bug, data leak
  • CVE-2025-50106: Glyph rendering memory bug, crash/code exec
  • Release notes: https://mail.openjdk.org/pipermail/jdk8u-dev/2025-July/020263.html

• Upgrade to openjdk-11.0.28+6 (GA).). The following CVEs were fixed:
• CVE-2025-30749: better Glyph drawing
• CVE-2025-30754: enhance TLS protocol support
• CVE-2025-30761: improve scripting supports
• CVE-2025-50059: improve HTTP client header handling
• CVE-2025-50106: better Glyph drawing redux

• OpenJDK 8u482 release, build 8. Release notes: https://mail.openjdk.org/pipermail/jdk8u-dev/2026-January/020959.html
  • Security fixes (8u482):
    • CVE-2026-21945: Prevent DoS via repeated crash or hang in sandbox security
    • CVE-2026-21932: Fix integrity issue in sandboxed handling of untrusted input
    • CVE-2026-21933: Prevent unauthorized data access or modification via networking APIs
    • CVE-2026-21925: Fix RMI flaw allowing unauthorized data read or modification
  • Previously fixed:
    • 8u472:
      • CVE-2025-53066: Prevent DoS or data exposure from untrusted input handling
      • CVE-2025-53057: Fix validation flaw affecting sandboxed networking/security logic
      • CVE-2025-61748: Prevent resource-consumption denial-of-service via crafted input
    • 8u462:
      • CVE-2025-30749: Fix security flaw enabling unauthorized actions or data exposure
      • CVE-2025-30754: Correct validation weakness affecting sandboxed execution integrity
      • CVE-2025-30761: Prevent unintended data access or via insufficient checks
      • CVE-2025-50106: Fix parsing weakness leading to potential denial-of-service
      • CVE-2025-50059: Fix improper HTTP header handling to prevent unintended requests

Better Glyph drawing. (CVE-2025-30749) Enhance TLS protocol support. (CVE-2025-30754) Improve scripting supports. (CVE-2025-30761) Improve HTTP client header handling. (CVE-2025-50059) Better Glyph drawing redux. (CVE-2025-50106)

These are all security issues fixed in the java-11-openjdk-11.0.28.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-17-openjdk-17.0.16.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-24-openjdk-24.0.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-21-openjdk-21.0.8.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-17-openj9-17.0.16.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-21-openj9-21.0.8.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for java-17-openj9 fixes the following issues:

Changes in java-17-openj9:

• Make post scripts less noisy (bsc#1267355)

• Use libalternatives instead of update-alternatives for distributions where libalternatives is available

• Update to OpenJDK 17.0.19 with OpenJ9 0.59.0 virtual machine

• Including Oracle April 2026 CPU changes

  • CVE-2026-22007 (bsc#1262490), CVE-2026-22013 (bsc#1262494), CVE-2026-22016 (bsc#1262495), CVE-2026-22018 (bsc#1262496), CVE-2026-22021 (bsc#1262497), CVE-2026-23865 (bsc#1259118), CVE-2026-34268 (bsc#1262500), CVE-2026-34282 (bsc#1262501)

• OpenJ9 specific security fix

  • CVE-2026-1188 (bsc#1265261)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.59/

• Update to OpenJDK 17.0.18 with OpenJ9 0.57.0 virtual machine

• Including Oracle January 2026 CPU changes

  • CVE-2026-21925 (bsc#1257034), CVE-2026-21932 (bsc#1257036), CVE-2026-21933 (bsc#1257037), CVE-2026-21945 (bsc#1257038)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.57/

• Do not depend on update-desktop-files (jsc#PED-14507)

• Update to OpenJDK 17.0.17 with OpenJ9 0.56.0 virtual machine

• Including Oracle October 2025 CPU changes

  • CVE-2025-53057 (bsc#1252414), CVE-2025-53066 (bsc#1252417)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.56/

• Update to OpenJDK 17.0.16 with OpenJ9 0.53.0 virtual machine

• Including Oracle July 2025 CPU changes

  • CVE-2025-30749 (bsc#1246595), CVE-2025-30754 (bsc#1246598), CVE-2025-50059 (bsc#1246575), CVE-2025-50106 (bsc#1246584)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.53/

• Enable bootcycle build

• Do not embed rebuild counter (bsc#1246806)

• Add -std=gnu99 to CFLAGS to fix gcc15 compile time error. Since the C++ part is on -std=gnu++98, this is the closest.

• Added patch:

  • fix-build-with-gcc15.patch
    • fix a typo in omr that is fatal with gcc15

• Update to OpenJDK 17.0.15 with OpenJ9 0.51.0 virtual machine

• Including Oracle April 2025 CPU changes

  • CVE-2025-21587 (bsc#1241274), CVE-2025-30691 (bsc#1241275), CVE-2025-30698 (bsc#1241276)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.51/

• fix wrong execstack flag in libj9jit (bsc#1235844)

• Update to OpenJDK 17.0.14 with OpenJ9 0.49.0 virtual machine

• Including Oracle October 2024 and January 2025 CPU changes

  • CVE-2024-21208 (bsc#1231702), CVE-2024-21210 (bsc#1231711), CVE-2024-21217 (bsc#1231716), CVE-2024-21235 (bsc#1231719), CVE-2025-21502 (bsc#1236278)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.49/

This update for java-21-openj9 fixes the following issues:

Changes in java-21-openj9:

• Make post scripts less noisy (bsc#1267355)

• Use libalternatives instead of update-alternatives for distributions where libalternatives is available

• Update to OpenJDK 21.0.11 with OpenJ9 0.59.0 virtual machine

• Including Oracle April 2026 CPU changes

  • CVE-2026-22007 (bsc#1262490), CVE-2026-22013 (bsc#1262494), CVE-2026-22016 (bsc#1262495), CVE-2026-22018 (bsc#1262496), CVE-2026-22021 (bsc#1262497), CVE-2026-23865 (bsc#1259118), CVE-2026-34268 (bsc#1262500), CVE-2026-34282 (bsc#1262501)

• OpenJ9 specific security fix

  • CVE-2026-1188 (bsc#1265261)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.59/

• Update to OpenJDK 21.0.10 with OpenJ9 0.57.0 virtual machine

• Including Oracle January 2026 CPU changes

  • CVE-2026-21925 (bsc#1257034), CVE-2026-21932 (bsc#1257036), CVE-2026-21933 (bsc#1257037), CVE-2026-21945 (bsc#1257038)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.57/

• Do not depend on update-desktop-files (jsc#PED-14507)

• Update to OpenJDK 21.0.9 with OpenJ9 0.56.0 virtual machine

• Including Oracle October 2025 CPU changes

  • CVE-2025-53057 (bsc#1252414), CVE-2025-53066 (bsc#1252417), CVE-2025-61748 (bsc#1252418)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.56/

• Update to OpenJDK 21.0.8 with OpenJ9 0.53.0 virtual machine

• Including Oracle July 2025 CPU changes

  • CVE-2025-30749 (bsc#1246595), CVE-2025-30754 (bsc#1246598), CVE-2025-50059 (bsc#1246575), CVE-2025-50106 (bsc#1246584)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.53/

• Enable bootcycle build

• Do not embed rebuild counter (bsc#1246806)

• Add -std=gnu99 to CFLAGS to fix gcc15 compile time error. Since the C++ part is on -std=gnu++98, this is the closest.

• Update to OpenJDK 21.0.7 with OpenJ9 0.51.0 virtual machine

• Including Oracle April 2025 CPU changes

  • CVE-2025-21587 (bsc#1241274), CVE-2025-30691 (bsc#1241275), CVE-2025-30698 (bsc#1241276)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.51/

• fix wrong execstack flag in libj9jit (bsc#1235844)

• Update to OpenJDK 21.0.6 with OpenJ9 0.49.0 virtual machine

• Including Oracle October 2024 and January 2025 CPU changes

  • CVE-2024-21208 (bsc#1231702), CVE-2024-21210 (bsc#1231711), CVE-2024-21217 (bsc#1231716), CVE-2024-21235 (bsc#1231719), CVE-2025-21502 (bsc#1236278)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.49/

This update for java-1_8_0-openj9 fixes the following issues:

Update to OpenJDK 8u462 build 08 with OpenJ9 0.53.0 virtual machine:

• CVE-2025-30749: several scenarios can lead to heap corruption (Oracle CPU 2025-07) (bsc#1246595)
• CVE-2025-30754: incomplete handshake may lead to weakening TLS protections (Oracle CPU 2025-07) (bsc#1246598)
• CVE-2025-30761: Improve scripting supports (Oracle CPU 2025-07) (bsc#1246580)
• CVE-2025-50059: Improve HTTP client header handling (Oracle CPU 2025-07) (bsc#1246575)

This update for java-11-openjdk fixes the following issues:

Upgrade to upstream tag jdk-11.0.28+6 (July 2025 CPU):

Security fixes:

• CVE-2025-30749: several scenarios can lead to heap corruption (bsc#1246595)
• CVE-2025-30754: incomplete handshake may lead to weakening TLS protections (bsc#1246598)
• CVE-2025-30761: Improve scripting supports (bsc#1246580)
• CVE-2025-50059: Improve HTTP client header handling (bsc#1246575)
• CVE-2025-50106: Glyph out-of-memory access and crash (bsc#1246584)

Changelog:

+ JDK-8026976: ECParameters, Point does not match field size
+ JDK-8211400: nsk.share.gc.Memory::getArrayLength returns wrong
  value
+ JDK-8231058: VerifyOops crashes with assert(_offset >= 0)
  failed: offset for non comment?
+ JDK-8232625: HttpClient redirect policy should be more
  conservative
+ JDK-8258483: [TESTBUG] gtest
  CollectorPolicy.young_scaled_initial_ergo_vm fails if heap is
  too small
+ JDK-8293345: SunPKCS11 provider checks on PKCS11 Mechanism are
  problematic
+ JDK-8296631: NSS tests failing on OL9 linux-aarch64 hosts
+ JDK-8301753: AppendFile/WriteFile has differences between make
  3.81 and 4+
+ JDK-8303770: Remove Baltimore root certificate expiring in May
  2025
+ JDK-8315380: AsyncGetCallTrace crash in frame::safe_for_sender
+ JDK-8327476: Upgrade JLine to 3.26.1
+ JDK-8328957: Update PKCS11Test.java to not use hardcoded path
+ JDK-8331959: Update PKCS#11 Cryptographic Token Interface to
  v3.1
+ JDK-8339300: CollectorPolicy.young_scaled_initial_ergo_vm
  gtest fails on ppc64 based platforms
+ JDK-8339728: [Accessibility,Windows,JAWS] Bug in the
  getKeyChar method of the AccessBridge class
+ JDK-8345133: Test sun/security/tools/jarsigner/
  /TsacertOptionTest.java failed: Warning found in stdout
+ JDK-8345625: Better HTTP connections
+ JDK-8346887: DrawFocusRect() may cause an assertion failure
+ JDK-8347629: Test FailOverDirectExecutionControlTest.java
  fails with -Xcomp
+ JDK-8348110: Update LCMS to 2.17
+ JDK-8348596: Update FreeType to 2.13.3
+ JDK-8348598: Update Libpng to 1.6.47
+ JDK-8348989: Better Glyph drawing
+ JDK-8349111: Enhance Swing supports
+ JDK-8349594: Enhance TLS protocol support
+ JDK-8350469: [11u] Test AbsPathsInImage.java fails
  - JDK-8239429 public clone
+ JDK-8350498: Remove two Camerfirma root CA certificates
+ JDK-8350991: Improve HTTP client header handling
+ JDK-8351099: Bump update version of OpenJDK: 11.0.28
+ JDK-8351422: Improve scripting supports
+ JDK-8352302: Test sun/security/tools/jarsigner/
  /TimestampCheck.java is failing
+ JDK-8352716: (tz) Update Timezone Data to 2025b
+ JDK-8356096: ISO 4217 Amendment 179 Update
+ JDK-8356571: Re-enable -Wtype-limits for GCC in LCMS
+ JDK-8359170: Add 2 TLS and 2 CS Sectigo roots
+ JDK-8360147: Better Glyph drawing redux

This update for java-21-openjdk fixes the following issues:

Update to upstream tag jdk-21.0.8+9 (July 2025 CPU):

Security fixes:

• CVE-2025-30749: several scenarios can lead to heap corruption (bsc#1246595)
• CVE-2025-30754: incomplete handshake may lead to weakening TLS protections (bsc#1246598)
• CVE-2025-50059: Improve HTTP client header handling (bsc#1246575)
• CVE-2025-50106: Glyph out-of-memory access and crash (bsc#1246584)

Other fixes:

• Allow compilation of openjdk for 40 years (bsc#1213796)

Changelog:

+ JDK-6956385: URLConnection.getLastModified() leaks file
  handles for jar:file and file: URLs
+ JDK-8051591: Test
  javax/swing/JTabbedPane/8007563/Test8007563.java fails
+ JDK-8136895: Writer not closed with disk full error, file
  resource leaked
+ JDK-8180450: secondary_super_cache does not scale well
+ JDK-8183348: Better cleanup for
  jdk/test/sun/security/pkcs12/P12SecretKey.java
+ JDK-8200566: DistributionPointFetcher fails to fetch CRLs if
  the DistributionPoints field contains more than one
  DistributionPoint and the first one fails
+ JDK-8202100: Merge vm/share/InMemoryJavaCompiler w/
  jdk/test/lib/compiler/InMemoryJavaCompiler
+ JDK-8210471: GZIPInputStream constructor could leak an
  un-end()ed Inflater
+ JDK-8211400: nsk.share.gc.Memory::getArrayLength returns
  wrong value
+ JDK-8220213: com/sun/jndi/dns/ConfigTests/Timeout.java
  failed intermittent
+ JDK-8249831: Test sun/security/mscapi/nonUniqueAliases/
  /NonUniqueAliases.java is marked with @ignore
+ JDK-8253440: serviceability/sa/TestJhsdbJstackLineNumbers.java
  failed with 'Didn't find enough line numbers'
+ JDK-8256211: assert fired in
  java/net/httpclient/DependentPromiseActionsTest (infrequent)
+ JDK-8258483: [TESTBUG] gtest
  CollectorPolicy.young_scaled_initial_ergo_vm fails if heap is
  too small
+ JDK-8267174: Many test files have the wrong Copyright header
+ JDK-8270269: Desktop.browse method fails if earlier
  CoInitialize call as COINIT_MULTITHREADED
+ JDK-8276995: Bug in jdk.jfr.event.gc.collection.TestSystemGC
+ JDK-8279016: JFR Leak Profiler is broken with Shenandoah
+ JDK-8280991: [XWayland] No displayChanged event after
  setDisplayMode call
+ JDK-8281511: java/net/ipv6tests/UdpTest.java fails with
  checkTime failed
+ JDK-8282726: java/net/vthread/BlockingSocketOps.java
  timeout/hang intermittently on Windows
+ JDK-8286204: [Accessibility,macOS,VoiceOver] VoiceOver reads
  the spinner value 10 as 1 when user iterates to 10 for the
  first time on macOS
+ JDK-8286789: Test forceEarlyReturn002.java timed out
+ JDK-8286875: ProgrammableUpcallHandler::on_entry/on_exit
  access thread fields from native
+ JDK-8294155: Exception thrown before awaitAndCheck hangs
  PassFailJFrame
+ JDK-8295804: javax/swing/JFileChooser/
  /JFileChooserSetLocationTest.java failed with 'setLocation()
  is not working properly'
+ JDK-8297692: Avoid sending per-region GCPhaseParallel JFR
  events in G1ScanCollectionSetRegionClosure
+ JDK-8303770: Remove Baltimore root certificate expiring in
  May 2025
+ JDK-8305010: Test vmTestbase/nsk/jvmti/scenarios/sampling/
  /SP05/sp05t003/TestDescription.java timed out: thread not
  suspended
+ JDK-8307318: Test serviceability/sa/
  /ClhsdbCDSJstackPrintAll.java failed:
  ArrayIndexOutOfBoundsException
+ JDK-8307824: Clean up Finalizable.java and finalize
  terminology in vmTestbase/nsk/share
+ JDK-8308033: The jcmd thread dump related tests should test
  virtual threads
+ JDK-8308966: Add intrinsic for float/double modulo for x86
  AVX2 and AVX512
+ JDK-8309667: TLS handshake fails because of
  ConcurrentModificationException in PKCS12KeyStore
  .engineGetEntry
+ JDK-8309841: Jarsigner should print a warning if an entry…

This update for java-11-openjdk fixes the following issues:

Upgrade to upstream tag jdk-11.0.28+6 (July 2025 CPU):

Security fixes:

• CVE-2025-30749: several scenarios can lead to heap corruption (bsc#1246595)
• CVE-2025-30754: incomplete handshake may lead to weakening TLS protections (bsc#1246598)
• CVE-2025-30761: Improve scripting supports (bsc#1246580)
• CVE-2025-50059: Improve HTTP client header handling (bsc#1246575)
• CVE-2025-50106: Glyph out-of-memory access and crash (bsc#1246584)

Changelog:

+ JDK-8026976: ECParameters, Point does not match field size
+ JDK-8211400: nsk.share.gc.Memory::getArrayLength returns wrong
  value
+ JDK-8231058: VerifyOops crashes with assert(_offset >= 0)
  failed: offset for non comment?
+ JDK-8232625: HttpClient redirect policy should be more
  conservative
+ JDK-8258483: [TESTBUG] gtest
  CollectorPolicy.young_scaled_initial_ergo_vm fails if heap is
  too small
+ JDK-8293345: SunPKCS11 provider checks on PKCS11 Mechanism are
  problematic
+ JDK-8296631: NSS tests failing on OL9 linux-aarch64 hosts
+ JDK-8301753: AppendFile/WriteFile has differences between make
  3.81 and 4+
+ JDK-8303770: Remove Baltimore root certificate expiring in May
  2025
+ JDK-8315380: AsyncGetCallTrace crash in frame::safe_for_sender
+ JDK-8327476: Upgrade JLine to 3.26.1
+ JDK-8328957: Update PKCS11Test.java to not use hardcoded path
+ JDK-8331959: Update PKCS#11 Cryptographic Token Interface to
  v3.1
+ JDK-8339300: CollectorPolicy.young_scaled_initial_ergo_vm
  gtest fails on ppc64 based platforms
+ JDK-8339728: [Accessibility,Windows,JAWS] Bug in the
  getKeyChar method of the AccessBridge class
+ JDK-8345133: Test sun/security/tools/jarsigner/
  /TsacertOptionTest.java failed: Warning found in stdout
+ JDK-8345625: Better HTTP connections
+ JDK-8346887: DrawFocusRect() may cause an assertion failure
+ JDK-8347629: Test FailOverDirectExecutionControlTest.java
  fails with -Xcomp
+ JDK-8348110: Update LCMS to 2.17
+ JDK-8348596: Update FreeType to 2.13.3
+ JDK-8348598: Update Libpng to 1.6.47
+ JDK-8348989: Better Glyph drawing
+ JDK-8349111: Enhance Swing supports
+ JDK-8349594: Enhance TLS protocol support
+ JDK-8350469: [11u] Test AbsPathsInImage.java fails
  - JDK-8239429 public clone
+ JDK-8350498: Remove two Camerfirma root CA certificates
+ JDK-8350991: Improve HTTP client header handling
+ JDK-8351099: Bump update version of OpenJDK: 11.0.28
+ JDK-8351422: Improve scripting supports
+ JDK-8352302: Test sun/security/tools/jarsigner/
  /TimestampCheck.java is failing
+ JDK-8352716: (tz) Update Timezone Data to 2025b
+ JDK-8356096: ISO 4217 Amendment 179 Update
+ JDK-8356571: Re-enable -Wtype-limits for GCC in LCMS
+ JDK-8359170: Add 2 TLS and 2 CS Sectigo roots
+ JDK-8360147: Better Glyph drawing redux

This update for java-17-openjdk fixes the following issues:

Upgrade to upstream tag jdk-17.0.16+8 (July 2025 CPU):

• CVE-2025-30749: several scenarios can lead to heap corruption (bsc#1246595)
• CVE-2025-30754: incomplete handshake may lead to weakening TLS protections (bsc#1246598)
• CVE-2025-50059: Improve HTTP client header handling (bsc#1246575)
• CVE-2025-50106: Glyph out-of-memory access and crash (bsc#1246584)

Changelog:

+ JDK-4850101: Setting mnemonic to VK_F4 underlines the letter
  S in a button.
+ JDK-5074006: Swing JOptionPane shows </html> tag as a string
  after newline
+ JDK-6956385: URLConnection.getLastModified() leaks file
  handles for jar:file and file: URLs
+ JDK-8024624: [TEST_BUG] [macosx] CTRL+RIGHT(LEFT) doesn't
  move selection on next cell in JTable on Aqua L&F
+ JDK-8042134: JOptionPane bungles HTML messages
+ JDK-8051591: Test
  javax/swing/JTabbedPane/8007563/Test8007563.java fails
+ JDK-8077371: Binary files in JAXP test should be removed
+ JDK-8183348: Better cleanup for
  jdk/test/sun/security/pkcs12/P12SecretKey.java
+ JDK-8196465:
  javax/swing/JComboBox/8182031/ComboPopupTest.java fails on
  Linux
+ JDK-8202100: Merge vm/share/InMemoryJavaCompiler w/
  jdk/test/lib/compiler/InMemoryJavaCompiler
+ JDK-8211400: nsk.share.gc.Memory::getArrayLength returns
  wrong value
+ JDK-8218474: JComboBox display issue with GTKLookAndFeel
+ JDK-8224267: JOptionPane message string with 5000+ newlines
  produces StackOverflowError
+ JDK-8249831: Test sun/security/mscapi/nonUniqueAliases/
  /NonUniqueAliases.java is marked with @ignore
+ JDK-8251505: Use of types in compiler shared code should be
  consistent.
+ JDK-8253440: serviceability/sa/TestJhsdbJstackLineNumbers.java
  failed with 'Didn't find enough line numbers'
+ JDK-8254786: java/net/httpclient/CancelRequestTest.java
  failing intermittently
+ JDK-8256211: assert fired in
  java/net/httpclient/DependentPromiseActionsTest (infrequent)
+ JDK-8258483: [TESTBUG] gtest
  CollectorPolicy.young_scaled_initial_ergo_vm fails if heap is
  too small
+ JDK-8269516: AArch64: Assembler cleanups
+ JDK-8271419: Refactor test code for modifying CDS archive
  contents
+ JDK-8276995: Bug in jdk.jfr.event.gc.collection.TestSystemGC
+ JDK-8277983: Remove unused fields from
  sun.net.www.protocol.jar.JarURLConnection
+ JDK-8279884: Use better file for cygwin source permission
  check
+ JDK-8279894: javax/swing/JInternalFrame/8020708/bug8020708.java
  timeouts on Windows 11
+ JDK-8280468: Crashes in getConfigColormap,
  getConfigVisualId, XVisualIDFromVisual on Linux
+ JDK-8280820: Clean up bug8033699 and bug8075609.java tests:
  regtesthelpers aren't used
+ JDK-8280991: [XWayland] No displayChanged event after
  setDisplayMode call
+ JDK-8281511: java/net/ipv6tests/UdpTest.java fails with
  checkTime failed
+ JDK-8282863: java/awt/FullScreen/FullscreenWindowProps/
  /FullscreenWindowProps.java fails on Windows 10 with HiDPI
  screen
+ JDK-8286204: [Accessibility,macOS,VoiceOver] VoiceOver reads
  the spinner value 10 as 1 when user iterates to 10 for the
  first time on macOS
+ JDK-8286789: Test forceEarlyReturn002.java timed out
+ JDK-8286875: ProgrammableUpcallHandler::on_entry/on_exit
  access thread fields from native
+ JDK-8286925: Move JSON parser used in JFR tests to test
  library
+ JDK-8287352: DockerTestUtils::execute shows incorrect
  elapsed time
+ JDK-8287801: Fix test-bugs related to stress flags
+ JDK-8288707: javax/swing/JToolBar/4529206/bug4529206.java:
  setFloating does not work correctly
+ JDK-8290162: Reset recursion counter missed in fix of
  JDK-8224267
+ JDK-8292064: Convert java/lang/management/MemoryMXBean shell
  tests to java version
+…

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 8 Fix Pack 50.

Security issues fixed:

• Oracle July 15 2025 CPU (bsc#1247754).
• CVE-2025-30749: heap corruption allows unauthenticated attacker with network access to compromise and takeover Java applications that load and run untrusted code (bsc#1246595).
• CVE-2025-30754: incomplete handshake allows unauthenticated attacker with network access via TLS to gain unauthorized update, insert, delete and read access to sensitive data (bsc#1246598).
• CVE-2025-30761: issue in the Scripting component allows unauthenticated attacker with network access to gain unauthorized creation, deletion or modification access to critical data (bsc#1246580).
• CVE-2025-50059: issue in the Networking component allows unauthenticated attacker with network access to gain unauthorized access to critical data (bsc#1246575).
• CVE-2025-50106: Glyph out-of-memory access allows unauthenticated attacker with network access to compromise and takeover Java applications that load and run untrusted code (bsc#1246584).

Other issues fixed.

• Class Libraries:
  • Oracle Security Fix 8348989: Better Glyph drawing.
  • Removal of Baltimore root certificate and TWO CAMERFIRMA root CA certificates from CACERTS.
  • Update timezone information to the latest TZDATA2025B.
• Java Virtual Machine:
  • Assertion failure at copyforwardscheme.cpp.
• JIT Compiler:
  • GC assert due to an invalid object reference.
  • SIGILL from JIT compiled method.
  • Unexpected behaviour with very large arrays.
• Security:
  • Deserialization of a serialized RSAPrivateCrtKey is throwing an exception.
  • EDDSAsignature fails when doing multiple update.
  • HTTPS channel binding support.
  • IBMJCEPlus provider supports post quantum cryptography algorithms ML-KEM (key encapsulation) and ML-DSA (digital signature).
  • Key certificate management: Extended key usage cannot be set without having key usage extension in certificate request.
  • MessageDigest.update API does not throw the correct exception.
  • Oracle Security Fix 8349594: Enhance TLS protocol support.
  • Problem getting key in PKCS12 keystore on MAC.
  • TLS support for the EDDSA signature algorithm.
  • Wrong algorithm name returned for EDDSA keys.
• z/OS Extentions:
  • IBMJCEHybridException with hybrid provider in GCM mode.

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 8 Fix Pack 50.

Security issues fixed:

• Oracle July 15 2025 CPU (bsc#1247754).
• CVE-2025-30749: heap corruption allows unauthenticated attacker with network access to compromise and takeover Java applications that load and run untrusted code (bsc#1246595).
• CVE-2025-30754: incomplete handshake allows unauthenticated attacker with network access via TLS to gain unauthorized update, insert, delete and read access to sensitive data (bsc#1246598).
• CVE-2025-30761: issue in the Scripting component allows unauthenticated attacker with network access to gain unauthorized creation, deletion or modification access to critical data (bsc#1246580).
• CVE-2025-50059: issue in the Networking component allows unauthenticated attacker with network access to gain unauthorized access to critical data (bsc#1246575).
• CVE-2025-50106: Glyph out-of-memory access allows unauthenticated attacker with network access to compromise and takeover Java applications that load and run untrusted code (bsc#1246584).

Other issues fixed:

• Class Libraries:
  • Oracle Security Fix 8348989: Better Glyph drawing.
  • Removal of Baltimore root certificate and TWO CAMERFIRMA root CA certificates from CACERTS.
  • Update timezone information to the latest TZDATA2025B.
• Java Virtual Machine:
  • Assertion failure at copyforwardscheme.cpp.
• JIT Compiler:
  • GC assert due to an invalid object reference.
  • SIGILL from JIT compiled method.
  • Unexpected behaviour with very large arrays.
• Security:
  • Deserialization of a serialized RSAPrivateCrtKey is throwing an exception.
  • EDDSAsignature fails when doing multiple update.
  • HTTPS channel binding support.
  • IBMJCEPlus provider supports post quantum cryptography algorithms ML-KEM (key encapsulation) and ML-DSA (digital signature).
  • Key certificate management: Extended key usage cannot be set without having key usage extension in certificate request.
  • MessageDigest.update API does not throw the correct exception.
  • Oracle Security Fix 8349594: Enhance TLS protocol support.
  • Problem getting key in PKCS12 keystore on MAC.
  • TLS support for the EDDSA signature algorithm.
  • Wrong algorithm name returned for EDDSA keys.
• z/OS Extentions:
  • IBMJCEHybridException with hybrid provider in GCM mode.