CVE-2025-21502

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM for JDK: 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM Enterprise Edition: 20.3.16 and 21.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

• JDK: Enhance array handling (CVE-2025-21502)

Bug Fix(es):

• The Rocky Enterprise Software Foundation OpenJDK packages rely on the copy-jdk-configs package to transfer configuration files to a new updated JDK. With this update, the JDK has been updated to use the latest version of copy-jdk-configs, which has been used for some years on later Rocky Linux versions (Rocky Linux-73867, Rocky Linux-73871, Rocky Linux-73872).

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM for JDK: 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM Enterprise Edition: 20.3.16 and 21.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

• JDK: Enhance array handling (CVE-2025-21502)

Bug Fix(es):

• The AlmaLinux OpenJDK packages rely on the copy-jdk-configs package to transfer configuration files to a new updated JDK. With this update, the JDK has been updated to use the latest version of copy-jdk-configs, which has been used for some years on later AlmaLinux versions (AlmaLinux-73867, AlmaLinux-73871, AlmaLinux-73872).

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.

Security Fix(es):

• JDK: Enhance array handling (CVE-2025-21502)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM for JDK: 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM Enterprise Edition: 20.3.16 and 21.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM for JDK: 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM Enterprise Edition: 20.3.16 and 21.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM for JDK: 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM Enterprise Edition: 20.3.16 and 21.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

• Upgrade to openjdk-11.0.26+4. The following CVEs were fixed:
• CVE-2024-21131: potential UTF8 size overflow
• CVE-2024-21138: excessive symbol length can lead to infinite loop
• CVE-2024-21140: range Check Elimination (RCE) pre-loop limit overflow
• CVE-2024-21144: Pack200 increase loading time due to improper header validation
• CVE-2024-21145: out-of-bounds access in 2D image handling
• CVE-2024-21147: RangeCheckElimination array index overflow
• CVE-2024-21208: HTTP client improper handling of maxHeaderSize
• CVE-2024-21210: array indexing integer overflow
• CVE-2024-21217: unbounded allocation leads to out-of-memory error
• CVE-2024-21235: integer conversion error leads to incorrect range check
• CVE-2025-21502: enhance array handling

• Upgrade to openjdk-11.0.27+6. The following CVEs were fixed:
• CVE-2025-30698: fix buffered image handling to avoid unauthorized access to accessible data
• CVE-2025-30691: improve compiler transformations to avoid unauthorized access to accessible data
• CVE-2024-21144: invalid header validation leads to Pack200 excessive loading time
• CVE-2024-21147: out-of-bounds array index in range check elimination
• CVE-2024-21138: infinite loop vunlerability in SymbolTable
• CVE-2024-21131: UTF8 size overflow
• CVE-2024-21235: incorrect range check because of integer conversion error in LoopNode
• CVE-2024-21140: int overflow/underflow in range check elimination
• CVE-2024-21217: out-of-memory because of unbounded allocation in MessageFormat
• CVE-2024-21210: integer overflow in array indexing in SuperWord
• CVE-2024-21145: out-of-bounds access in MaskFill
• CVE-2024-21208: improper handling of maxHeaderSize in HTTP client
• CVE-2025-21502: enhance array handling

• Update to jdk-17.0.15+6
• Set bundled freetype provide version to 2.13.2
• Set bundled harfbuzz provide version to 8.2.2
• Require tzdata-java 2025a at runtime and for build
• CVE-2025-21502: fix Hotspot component vulnerability allowing unauthorized access to resources and exposure of sensitive information
• CVE-2025-30698: fix 2D component vulnerability allowing unauthorized data access and partial denial of service
• CVE-2025-30691: fix Compiler component vulnerability allowing unauthorized data access and modification (CVSS 4.8 Medium)
• CVE-2025-21587: fix JSSE component vulnerability allowing unauthorized creation/deletion/modification of critical data
• CVE-2024-20921: fix information disclosure in Hotspot that allows remote attackers to access sensitive data via untrusted input through exposed APIs or sandboxed environments
• CVE-2024-21235: fix vulnerability in Hotspot that allows remote attackers to read or modify limited data via untrusted input through exposed APIs or sandboxed code
• CVE-2024-21217: fix vulnerability in Serialization that allows remote attackers to trigger partial denial of service via untrusted input through exposed APIs or sandboxed code
• CVE-2024-21210: fix vulnerability in Hotspot that allows remote attackers to modify limited data via untrusted input through exposed APIs or sandboxed code.
• CVE-2024-21208: fix security vulnerability in OpenJDK component
• CVE-2024-21147: fix Hotspot component vulnerability allowing unauthorized data access
• CVE-2024-21145: fix 2D component vulnerability allowing unauthorized data access
• CVE-2024-21144: fix security vulnerability in OpenJDK component
• CVE-2024-21140: fix Hotspot component vulnerability
• CVE-2024-21138: fix Hotspot component vulnerability causing partial denial of service
• CVE-2024-21131: fix vulnerability in Hotspot that allows remote attackers to modify limited data via untrusted input through exposed APIs or sandboxed code
• CVE-2024-21094: fix Hotspot component vulnerability allowing unauthorized data modification
• CVE-2024-21085: fix Concurrency component vulnerability causing partial denial of service
• CVE-2024-21068: fix Hotspot component vulnerability allowing unauthorized data access
• CVE-2024-21011: fix Hotspot component vulnerability causing partial denial of service
• CVE-2024-20918: fix information disclosure and data modification in Hotspot via untrusted input
• CVE-2024-20952: fix information disclosure and data modification in Security via untrusted input
• CVE-2024-20926: fix information disclosure in Scripting via untrusted input
• CVE-2023-48161: fix buffer overflow in GifLib’s DumpSCreen2RGB function allowing local attackers to access sensitive information
• CVE-2023-22025: fix data modification in Hotspot via untrusted input through exposed APIs or sandboxed code
• CVE-2023-25193: fix O(n^2) growth vulnerability in HarfBuzz's hb-ot-layout-gsubgpos.hh when processing consecutive marks

• Security fixes from OpenJDK 8u452-b09:
• CVE-2025-21587: JSSE issue allowing remote access or modification of sensitive data
• CVE-2025-30698: allows limited data access and partial DoS via untrusted Java code
• CVE-2025-30691: allows limited data access via untrusted code using compiler APIs
• Security fixes from OpenJDK 8u442-b06:
• CVE-2025-21502: hotspot vulnerability enabling limited data access java clients
• Security fixes from OpenJDK 8u432-b06:
• CVE-2024-21235: sandbox bypass in java clients via exposed APIs
• CVE-2024-21208: network flaw in sandboxed java clients enabling limited DoS
• CVE-2024-21210: enabling data modification in sandboxed clients via crafted API input
• CVE-2024-21217: serialization flaw may trigger partial DoS in sandboxed environments
• Security fixes from OpenJDK 8u422-b05:
• CVE-2024-21147: hotspot issue may lead to unauthorized access of sensitive data
• CVE-2024-21145: enable limited unauthorized data access via untrusted java code
• CVE-2024-21140: expose limited data to unauthorized read/write via sandboxed java code
• CVE-2024-21144: allow remote unauthenticated attacker to cause partial DoS
• CVE-2024-21131: remote access via API may lead to limited data modification
• CVE-2024-21138: remote API calls may trigger partial DoS in sandboxed java environments
• Security fixes from OpenJDK 8u412-b08:
• CVE-2024-21094: lead to unauthorized data changes in sandboxed java apps
• CVE-2024-21085: concurrency flaw may cause partial DoS in sandboxed java environments
• CVE-2024-21011: hotspot issue may trigger partial DoS in sandboxed java environments
• CVE-2024-21068: lead to limited unauthorized data modification in sandboxed deployments
• CVE-2024-21012: networking issue may allow limited data modification

A difficult to exploit vulnerability allows unauthenticated attackers with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to Oracle Java SE accessible. This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the Internet) and rely on the Java sandbox for security. (CVE-2025-21502)

This update for java-11-openj9 fixes the following issues:

• Update to OpenJDK 11.0.26 with OpenJ9 0.49.0 virtual machine

• Including Oracle October 2024 and January 2025 CPU changes

  • CVE-2024-21208 (boo#1231702), CVE-2024-21210 (boo#1231711), CVE-2024-21217 (boo#1231716), CVE-2024-21235 (boo#1231719), CVE-2025-21502 (boo#1236278)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.49/

• Update to OpenJDK 11.0.24 with OpenJ9 0.46.0 virtual machine

• Including Oracle July 2024 CPU changes

  • CVE-2024-21131 (boo#1228046), CVE-2024-21138 (boo#1228047), CVE-2024-21140 (boo#1228048), CVE-2024-21144 (boo#1228050), CVE-2024-21147 (boo#1228052), CVE-2024-21145 (boo#1228051)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.46/

• Update to OpenJDK 11.0.23 with OpenJ9 0.44.0 virtual machine

• Including Oracle April 2024 CPU changes

  • CVE-2024-21012 (boo#1222987), CVE-2024-21094 (boo#1222986), CVE-2024-21011 (boo#1222979), CVE-2024-21085 (boo#1222984), CVE-2024-21068 (boo#1222983)

• Including OpenJ9/OMR specific fix:

  • CVE-2024-3933 (boo#1225470)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.44/

• Update to OpenJDK 11.0.22 with OpenJ9 0.43.0 virtual machine

• Including Oracle January 2024 CPU changes

  • CVE-2024-20918 (boo#1218907), CVE-2024-20919 (boo#1218903), CVE-2024-20921 (boo#1218905), CVE-2024-20926 (boo#1218906), CVE-2024-20945 (boo#1218909), CVE-2024-20952 (boo#1218911)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.43/

• Remove the possibility to put back removes JavaEE modules, since our Java stack does not need this hack any more

• Update to OpenJDK 11.0.21 with OpenJ9 0.41.0 virtual machine

• Including Oracle October 2023 CPU changes

  • CVE-2023-22081, boo#1216374

• Including Openj9 0.41.0 fixes of CVE-2023-5676, boo#1217214

  • For other OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.41

• Update to OpenJDK 11.0.20.1 with OpenJ9 0.40.0 virtual machine

  • JDK-8313765: Invalid CEN header (invalid zip64 extra data field size)

• Update to OpenJDK 11.0.20 with OpenJ9 0.40.0 virtual machine

• Including Oracle April 2023 CPU changes

  • CVE-2023-22006 (boo#1213473), CVE-2023-22036 (boo#1213474), CVE-2023-22041 (boo#1213475), CVE-2023-22045 (boo#1213481), CVE-2023-22049 (boo#1213482), CVE-2023-25193 (boo#1207922)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.40

• Update to OpenJDK 11.0.19 with OpenJ9 0.38.0 virtual machine

• Including Oracle April 2023 CPU changes

  • CVE-2023-21930 (boo#1210628), CVE-2023-21937 (boo#1210631), CVE-2023-21938 (boo#1210632), CVE-2023-21939 (boo#1210634), CVE-2023-21954 (boo#1210635), CVE-2023-21967 (boo#1210636), CVE-2023-21968 (boo#1210637)
  • OpenJ9 specific vulnerability: CVE-2023-2597 (boo#1211615)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.38

• Update to OpenJDK 11.0.18 with OpenJ9 0.36.1 virtual machine

  • Including Oracle January 2023 CPU changes
    • CVE-2023-21835, boo#1207246
    • CVE-2023-21843, boo#1207248
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.36

• Update to OpenJDK 11.0.17 with OpenJ9 0.35.0 virtual machine

  • Including Oracle October 2022 CPU changes CVE-2022-21618 (boo#1204468), CVE-2022-21619 (boo#1204473), CVE-2022-21626 (boo#1204471), CVE-2022-21624 (boo#1204475), CVE-2022-21628 (boo#1204472), CVE-2022-39399 (boo#1204480)
  • Fixes OpenJ9 vulnerability boo#1204703, CVE-2022-3676
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.35

• Update to OpenJDK 11.0.16 with OpenJ9 0.33.0 virtual machine

  • Including Oracle July 2022 CPU changes CVE-2022-21540 (boo#1201694), CVE-2022-21541 (boo#1201692), CVE-2022-34169 (boo#1201684)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.33

• Update to OpenJDK 11.0.15 with OpenJ9…

This update for java-17-openj9 fixes the following issues:

• Update to OpenJDK 17.0.14 with OpenJ9 0.49.0 virtual machine

• Including Oracle October 2024 and January 2025 CPU changes

  • CVE-2024-21208 (boo#1231702), CVE-2024-21210 (boo#1231711), CVE-2024-21217 (boo#1231716), CVE-2024-21235 (boo#1231719), CVE-2025-21502 (boo#1236278)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.49/

• Update to OpenJDK 17.0.12 with OpenJ9 0.46.0 virtual machine

• Including Oracle July 2024 CPU changes

  • CVE-2024-21131 (boo#1228046), CVE-2024-21138 (boo#1228047), CVE-2024-21140 (boo#1228048), CVE-2024-21147 (boo#1228052), CVE-2024-21145 (boo#1228051)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.46/

• Update to OpenJDK 17.0.11 with OpenJ9 0.44.0 virtual machine

• Including Oracle April 2024 CPU changes

  • CVE-2024-21012 (boo#1222987), CVE-2024-21094 (boo#1222986), CVE-2024-21011 (boo#1222979), CVE-2024-21068 (boo#1222983)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.44/

• Update to OpenJDK 17.0.10 with OpenJ9 0.43.0 virtual machine

• Including Oracle January 2024 CPU changes

  • CVE-2024-20918 (boo#1218907), CVE-2024-20919 (boo#1218903), CVE-2024-20921 (boo#1218905), CVE-2024-20932 (boo#1218908), CVE-2024-20945 (boo#1218909), CVE-2024-20952 (boo#1218911)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.43/

• Update to OpenJDK 17.0.9 with OpenJ9 0.41.0 virtual machine

• Including Oracle October 2023 CPU changes

  • CVE-2023-22081, boo#1216374
  • CVE-2023-22025, boo#1216339

• Including Openj9 0.41.0 fixes of CVE-2023-5676, boo#1217214

  • For other OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.41

• Update to OpenJDK 17.0.8.1 with OpenJ9 0.40.0 virtual machine

  • JDK-8313765: Invalid CEN header (invalid zip64 extra data field size)

• Update to OpenJDK 17.0.8 with OpenJ9 0.40.0 virtual machine

• Including Oracle July 2023 CPU changes

  • CVE-2023-22006 (boo#1213473), CVE-2023-22036 (boo#1213474), CVE-2023-22041 (boo#1213475), CVE-2023-22044 (boo#1213479), CVE-2023-22045 (boo#1213481), CVE-2023-22049 (boo#1213482), CVE-2023-25193 (boo#1207922)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.40

• Update to OpenJDK 17.0.7 with OpenJ9 0.38.0 virtual machine

• Including Oracle April 2023 CPU changes

  • CVE-2023-21930 (boo#1210628), CVE-2023-21937 (boo#1210631), CVE-2023-21938 (boo#1210632), CVE-2023-21939 (boo#1210634), CVE-2023-21954 (boo#1210635), CVE-2023-21967 (boo#1210636), CVE-2023-21968 (boo#1210637)
  • OpenJ9 specific vulnerability: CVE-2023-2597 (boo#1211615)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.38

• Update to OpenJDK 17.0.6 with OpenJ9 0.36.0 virtual machine

  • including Oracle January 2023 CPU changes
    • CVE-2023-21835, boo#1207246
    • CVE-2023-21843, boo#1207248
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.36

• Update to OpenJDK 17.0.5 with OpenJ9 0.35.0 virtual machine

  • Including Oracle October 2022 CPU changes CVE-2022-21618 (boo#1204468), CVE-2022-21619 (boo#1204473), CVE-2022-21626 (boo#1204471), CVE-2022-21624 (boo#1204475), CVE-2022-21628 (boo#1204472), CVE-2022-39399 (boo#1204480)
  • Fixes OpenJ9 vulnerability boo#1204703, CVE-2022-3676
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.35

These are all security issues fixed in the java-17-openjdk-17.0.14.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-11-openjdk-11.0.26.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-21-openjdk-21.0.6.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-11-openj9-11.0.26.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-17-openj9-17.0.14.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-21-openj9-21.0.6.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-23-openjdk-23.0.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for java-17-openj9 fixes the following issues:

Changes in java-17-openj9:

• Make post scripts less noisy (bsc#1267355)

• Use libalternatives instead of update-alternatives for distributions where libalternatives is available

• Update to OpenJDK 17.0.19 with OpenJ9 0.59.0 virtual machine

• Including Oracle April 2026 CPU changes

  • CVE-2026-22007 (bsc#1262490), CVE-2026-22013 (bsc#1262494), CVE-2026-22016 (bsc#1262495), CVE-2026-22018 (bsc#1262496), CVE-2026-22021 (bsc#1262497), CVE-2026-23865 (bsc#1259118), CVE-2026-34268 (bsc#1262500), CVE-2026-34282 (bsc#1262501)

• OpenJ9 specific security fix

  • CVE-2026-1188 (bsc#1265261)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.59/

• Update to OpenJDK 17.0.18 with OpenJ9 0.57.0 virtual machine

• Including Oracle January 2026 CPU changes

  • CVE-2026-21925 (bsc#1257034), CVE-2026-21932 (bsc#1257036), CVE-2026-21933 (bsc#1257037), CVE-2026-21945 (bsc#1257038)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.57/

• Do not depend on update-desktop-files (jsc#PED-14507)

• Update to OpenJDK 17.0.17 with OpenJ9 0.56.0 virtual machine

• Including Oracle October 2025 CPU changes

  • CVE-2025-53057 (bsc#1252414), CVE-2025-53066 (bsc#1252417)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.56/

• Update to OpenJDK 17.0.16 with OpenJ9 0.53.0 virtual machine

• Including Oracle July 2025 CPU changes

  • CVE-2025-30749 (bsc#1246595), CVE-2025-30754 (bsc#1246598), CVE-2025-50059 (bsc#1246575), CVE-2025-50106 (bsc#1246584)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.53/

• Enable bootcycle build

• Do not embed rebuild counter (bsc#1246806)

• Add -std=gnu99 to CFLAGS to fix gcc15 compile time error. Since the C++ part is on -std=gnu++98, this is the closest.

• Added patch:

  • fix-build-with-gcc15.patch
    • fix a typo in omr that is fatal with gcc15

• Update to OpenJDK 17.0.15 with OpenJ9 0.51.0 virtual machine

• Including Oracle April 2025 CPU changes

  • CVE-2025-21587 (bsc#1241274), CVE-2025-30691 (bsc#1241275), CVE-2025-30698 (bsc#1241276)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.51/

• fix wrong execstack flag in libj9jit (bsc#1235844)

• Update to OpenJDK 17.0.14 with OpenJ9 0.49.0 virtual machine

• Including Oracle October 2024 and January 2025 CPU changes

  • CVE-2024-21208 (bsc#1231702), CVE-2024-21210 (bsc#1231711), CVE-2024-21217 (bsc#1231716), CVE-2024-21235 (bsc#1231719), CVE-2025-21502 (bsc#1236278)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.49/

This update for java-21-openj9 fixes the following issues:

Changes in java-21-openj9:

• Make post scripts less noisy (bsc#1267355)

• Use libalternatives instead of update-alternatives for distributions where libalternatives is available

• Update to OpenJDK 21.0.11 with OpenJ9 0.59.0 virtual machine

• Including Oracle April 2026 CPU changes

  • CVE-2026-22007 (bsc#1262490), CVE-2026-22013 (bsc#1262494), CVE-2026-22016 (bsc#1262495), CVE-2026-22018 (bsc#1262496), CVE-2026-22021 (bsc#1262497), CVE-2026-23865 (bsc#1259118), CVE-2026-34268 (bsc#1262500), CVE-2026-34282 (bsc#1262501)

• OpenJ9 specific security fix

  • CVE-2026-1188 (bsc#1265261)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.59/

• Update to OpenJDK 21.0.10 with OpenJ9 0.57.0 virtual machine

• Including Oracle January 2026 CPU changes

  • CVE-2026-21925 (bsc#1257034), CVE-2026-21932 (bsc#1257036), CVE-2026-21933 (bsc#1257037), CVE-2026-21945 (bsc#1257038)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.57/

• Do not depend on update-desktop-files (jsc#PED-14507)

• Update to OpenJDK 21.0.9 with OpenJ9 0.56.0 virtual machine

• Including Oracle October 2025 CPU changes

  • CVE-2025-53057 (bsc#1252414), CVE-2025-53066 (bsc#1252417), CVE-2025-61748 (bsc#1252418)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.56/

• Update to OpenJDK 21.0.8 with OpenJ9 0.53.0 virtual machine

• Including Oracle July 2025 CPU changes

  • CVE-2025-30749 (bsc#1246595), CVE-2025-30754 (bsc#1246598), CVE-2025-50059 (bsc#1246575), CVE-2025-50106 (bsc#1246584)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.53/

• Enable bootcycle build

• Do not embed rebuild counter (bsc#1246806)

• Add -std=gnu99 to CFLAGS to fix gcc15 compile time error. Since the C++ part is on -std=gnu++98, this is the closest.

• Update to OpenJDK 21.0.7 with OpenJ9 0.51.0 virtual machine

• Including Oracle April 2025 CPU changes

  • CVE-2025-21587 (bsc#1241274), CVE-2025-30691 (bsc#1241275), CVE-2025-30698 (bsc#1241276)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.51/

• fix wrong execstack flag in libj9jit (bsc#1235844)

• Update to OpenJDK 21.0.6 with OpenJ9 0.49.0 virtual machine

• Including Oracle October 2024 and January 2025 CPU changes

  • CVE-2024-21208 (bsc#1231702), CVE-2024-21210 (bsc#1231711), CVE-2024-21217 (bsc#1231716), CVE-2024-21235 (bsc#1231719), CVE-2025-21502 (bsc#1236278)
  • OpenJ9 changes, see https://www.eclipse.org/openj9/docs/version0.49/

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.

Security Fix(es):

• JDK: Enhance array handling (CVE-2025-21502)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for java-11-openjdk fixes the following issues:

Upgrade to upstream tag jdk-11.0.26+4 (January 2025 CPU)

Security fixes:

• CVE-2025-21502: Enhance array handling (JDK-8330045, bsc#1236278)

Other changes:

• JDK-8224624: Inefficiencies in CodeStrings::add_comment cause - timeouts
• JDK-8225045: javax/swing/JInternalFrame/8146321//JInternalFrameIconTest.java fails on linux-x64
• JDK-8232367: Update Reactive Streams to 1.0.3 -- tests only
• JDK-8247706: Unintentional use of new Date(year...) with absolute year
• JDK-8299254: Support dealing with standard assert macro
• JDK-8303920: Avoid calling out to python in DataDescriptorSignatureMissing test
• JDK-8315936: Parallelize gc/stress/TestStressG1Humongous.java test
• JDK-8316193: jdk/jfr/event/oldobject/TestListenerLeak.java java.lang.Exception: Could not find leak
• JDK-8328300: Convert PrintDialogsTest.java from Applet to main program
• JDK-8328642: Convert applet test MouseDraggedOutCauseScrollingTest.html to main
• JDK-8334332: TestIOException.java fails if run by root
• JDK-8335428: Enhanced Building of Processes
• JDK-8335801: [11u] Backport of 8210988 to 11u removes gcc warnings
• JDK-8335912, JDK-8337499: Add an operation mode to the jar command when extracting to not overwriting existing files
• JDK-8336564: Enhance mask blit functionality redux
• JDK-8338402: GHA: some of bundles may not get removed
• JDK-8339082: Bump update version for OpenJDK: jdk-11.0.26
• JDK-8339180: Enhanced Building of Processes: Follow-on Issue
• JDK-8339470: [17u] More defensive fix for 8163921
• JDK-8339637: (tz) Update Timezone Data to 2024b
• JDK-8339644: Improve parsing of Day/Month in tzdata rules
• JDK-8339803: Acknowledge case insensitive unambiguous keywords in tzdata files
• JDK-8340552: Harden TzdbZoneRulesCompiler against missing zone names
• JDK-8340671: GHA: Bump macOS and Xcode versions to macos-12 and XCode 13.4.1
• JDK-8340815: Add SECURITY.md file
• JDK-8342426: [11u] javax/naming/module/RunBasic.java javac compile fails
• JDK-8342629: [11u] Properly message out that shenandoah is disabled
• JDK-8347483: [11u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 11.0.26

This update for java-21-openjdk fixes the following issues:

Upgrade to upstream tag jdk-21.0.6+7 (January 2025 CPU)

Security fixes:

• CVE-2025-21502: Enhance array handling (JDK-8330045, bsc#1236278)

Other changes:

• JDK-6942632: Hotspot should be able to use more than 64 logical processors on Windows
• JDK-8028127: Regtest java/security/Security/SynchronizedAccess.java is incorrect
• JDK-8195675: Call to insertText with single character from custom Input Method ignored
• JDK-8207908: JMXStatusTest.java fails assertion intermittently
• JDK-8225220: When the Tab Policy is checked,the scroll button direction displayed incorrectly.
• JDK-8240343: JDI stopListening/stoplis001 'FAILED: listening is successfully stopped without starting listening'
• JDK-8283214: [macos] Screen magnifier does not show the magnified text for JComboBox
• JDK-8296787: Unify debug printing format of X.509 cert serial numbers
• JDK-8296972: [macos13] java/awt/Frame/MaximizedToIconified/MaximizedToIconified.java: getExtendedState() != 6 as expected.
• JDK-8306446: java/lang/management/ThreadMXBean/Locks.java transient failures
• JDK-8308429: jvmti/StopThread/stopthrd007 failed with 'NoClassDefFoundError: Could not initialize class jdk.internal.misc.VirtualThreads'
• JDK-8309218: java/util/concurrent/locks/Lock/OOMEInAQS.java still times out with ZGC, Generational ZGC, and SerialGC
• JDK-8311301: MethodExitTest may fail with stack buffer overrun
• JDK-8311656: Shenandoah: Unused ShenandoahSATBAndRemarkThreadsClosure::_claim_token
• JDK-8312518: [macos13] setFullScreenWindow() shows black screen on macOS 13 & above
• JDK-8313374: --enable-ccache's CCACHE_BASEDIR breaks builds
• JDK-8313878: Exclude two compiler/rtm/locking tests on ppc64le
• JDK-8315701: [macos] Regression: KeyEvent has different keycode on different keyboard layouts
• JDK-8316428: G1: Nmethod count statistics only count last code root set iterated
• JDK-8316893: Compile without -fno-delete-null-pointer-checks
• JDK-8316895: SeenThread::print_action_queue called on a null pointer
• JDK-8316907: Fix nonnull-compare warnings
• JDK-8317116: Provide layouts for multiple test UI in PassFailJFrame
• JDK-8317575: AArch64: C2_MacroAssembler::fast_lock uses rscratch1 for cmpxchg result
• JDK-8318105: [jmh] the test java.security.HSS failed with 2 active threads
• JDK-8318442: java/net/httpclient/ManyRequests2.java fails intermittently on Linux
• JDK-8319640: ClassicFormat::parseObject (from DateTimeFormatter) does not conform to the javadoc and may leak DateTimeException
• JDK-8319673: Few security tests ignore VM flags
• JDK-8319678: Several tests from corelibs areas ignore VM flags
• JDK-8319960: RISC-V: compiler/intrinsics/TestInteger/LongUnsignedDivMod.java failed with 'counts: Graph contains wrong number of nodes'
• JDK-8319970: AArch64: enable tests compiler/intrinsics/Test(Long|Integer)UnsignedDivMod.java on aarch64
• JDK-8319973: AArch64: Save and restore FPCR in the call stub
• JDK-8320192: SHAKE256 does not work correctly if n >= 137
• JDK-8320397: RISC-V: Avoid passing t0 as temp register to MacroAssembler:: cmpxchg_obj_header/cmpxchgptr
• JDK-8320575: generic type information lost on mandated parameters of record's compact constructors
• JDK-8320586: update manual test/jdk/TEST.groups
• JDK-8320665: update jdk_core at open/test/jdk/TEST.groups
• JDK-8320673: PageFormat/CustomPaper.java has no Pass/Fail buttons; multiple instructions
• JDK-8320682: [AArch64] C1 compilation fails with 'Field too big for insn'
• JDK-8320892: AArch64: Restore FPU control state after JNI
• JDK-8321299: runtime/logging/ClassLoadUnloadTest.java doesn't reliably trigger class unloading
• JDK-8321470: ThreadLocal.nextHashCode can be static final
• JDK-8321474: TestAutoCreateSharedArchiveUpgrade.java should be updated with JDK 21
• JDK-8321543: Update NSS to version 3.96
• JDK-8321550: Update several runtime/cds tests to use vm flags or mark as flagless
• JDK-8321616: Retire binary test vectors in…

This update for java-11-openjdk fixes the following issues:

Upgrade to upstream tag jdk-11.0.26+4 (January 2025 CPU)

Security fixes:

• CVE-2025-21502: Enhance array handling (JDK-8330045, bsc#1236278)

Other changes:

• JDK-8224624: Inefficiencies in CodeStrings::add_comment cause - timeouts
• JDK-8225045: javax/swing/JInternalFrame/8146321//JInternalFrameIconTest.java fails on linux-x64
• JDK-8232367: Update Reactive Streams to 1.0.3 -- tests only
• JDK-8247706: Unintentional use of new Date(year...) with absolute year
• JDK-8299254: Support dealing with standard assert macro
• JDK-8303920: Avoid calling out to python in DataDescriptorSignatureMissing test
• JDK-8315936: Parallelize gc/stress/TestStressG1Humongous.java test
• JDK-8316193: jdk/jfr/event/oldobject/TestListenerLeak.java java.lang.Exception: Could not find leak
• JDK-8328300: Convert PrintDialogsTest.java from Applet to main program
• JDK-8328642: Convert applet test MouseDraggedOutCauseScrollingTest.html to main
• JDK-8334332: TestIOException.java fails if run by root
• JDK-8335428: Enhanced Building of Processes
• JDK-8335801: [11u] Backport of 8210988 to 11u removes gcc warnings
• JDK-8335912, JDK-8337499: Add an operation mode to the jar command when extracting to not overwriting existing files
• JDK-8336564: Enhance mask blit functionality redux
• JDK-8338402: GHA: some of bundles may not get removed
• JDK-8339082: Bump update version for OpenJDK: jdk-11.0.26
• JDK-8339180: Enhanced Building of Processes: Follow-on Issue
• JDK-8339470: [17u] More defensive fix for 8163921
• JDK-8339637: (tz) Update Timezone Data to 2024b
• JDK-8339644: Improve parsing of Day/Month in tzdata rules
• JDK-8339803: Acknowledge case insensitive unambiguous keywords in tzdata files
• JDK-8340552: Harden TzdbZoneRulesCompiler against missing zone names
• JDK-8340671: GHA: Bump macOS and Xcode versions to macos-12 and XCode 13.4.1
• JDK-8340815: Add SECURITY.md file
• JDK-8342426: [11u] javax/naming/module/RunBasic.java javac compile fails
• JDK-8342629: [11u] Properly message out that shenandoah is disabled
• JDK-8347483: [11u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 11.0.26

This update for java-17-openjdk fixes the following issues:

Update to upstream tag jdk-17.0.14+7 (January 2025 CPU):

Security fixes:

• CVE-2025-21502: Enhance array handling (JDK-8330045, bsc#1236278)

Other changes:

• JDK-7093691: Nimbus LAF: disabled JComboBox using renderer has bad font color
• JDK-8028127: Regtest java/security/Security/SynchronizedAccess.java is incorrect
• JDK-8071693: Introspector ignores default interface methods
• JDK-8195675: Call to insertText with single character from custom Input Method ignored
• JDK-8202926: Test java/awt/Focus/WindowUpdateFocusabilityTest/WindowUpdateFocusabilityTest.html fails
• JDK-8207908: JMXStatusTest.java fails assertion intermittently
• JDK-8225220: When the Tab Policy is checked,the scroll button direction displayed incorrectly.
• JDK-8240343: JDI stopListening/stoplis001 'FAILED: listening is successfully stopped without starting listening'
• JDK-8254759: [TEST_BUG] [macosx] javax/swing/JInternalFrame/4202966/IntFrameCoord.html fails
• JDK-8258734: jdk/jfr/event/oldobject/TestClassLoaderLeak.java failed with 'RuntimeException: Could not find class leak'
• JDK-8268364: jmethod clearing should be done during unloading
• JDK-8269770: nsk tests should start IOPipe channel before launch debuggee - Debugee.prepareDebugee
• JDK-8271003: hs_err improvement: handle CLASSPATH env setting longer than O_BUFLEN
• JDK-8271456: Avoid looking up standard charsets in 'java.desktop' module
• JDK-8271821: mark hotspot runtime/MinimalVM tests which ignore external VM flags
• JDK-8271825: mark hotspot runtime/LoadClass tests which ignore external VM flags
• JDK-8271836: runtime/ErrorHandling/ClassPathEnvVar.java fails with release VMs
• JDK-8272746: ZipFile can't open big file (NegativeArraySizeException)
• JDK-8273914: Indy string concat changes order of operations
• JDK-8274170: Add hooks for custom makefiles to augment jtreg test execution
• JDK-8274505: Too weak variable type leads to unnecessary cast in java.desktop
• JDK-8276763: java/nio/channels/SocketChannel/AdaptorStreams.java fails with 'SocketTimeoutException: Read timed out'
• JDK-8278527: java/util/concurrent/tck/JSR166TestCase.java fails nanoTime test
• JDK-8280131: jcmd reports 'Module jdk.jfr not found.' when 'jdk.management.jfr' is missing
• JDK-8281379: Assign package declarations to all jtreg test cases under gc
• JDK-8282578: AIOOBE in javax.sound.sampled.Clip
• JDK-8283214: [macos] Screen magnifier does not show the magnified text for JComboBox
• JDK-8283222: improve diagnosability of runtime/8176717/TestInheritFD.java timeouts
• JDK-8284291: sun/security/krb5/auto/Renew.java fails intermittently on Windows 11
• JDK-8284874: Add comment to ProcessHandle/OnExitTest to describe zombie problem
• JDK-8286160: (fs) Files.exists returns unexpected results with C:\pagefile.sys because it's not readable
• JDK-8287003: InputStreamReader::read() can return zero despite writing a char in the buffer
• JDK-8288976: classfile parser 'wrong name' error message has the names the wrong way around
• JDK-8289184: runtime/ClassUnload/DictionaryDependsTest.java failed with 'Test failed: should be unloaded'
• JDK-8290023: Remove use of IgnoreUnrecognizedVMOptions in gc tests
• JDK-8290269: gc/shenandoah/TestVerifyJCStress.java fails due to invalid tag: required after JDK-8290023
• JDK-8292309: Fix 'java/awt/PrintJob/ConstrainedPrintingTest/ConstrainedPrintingTest.java' test
• JDK-8293061: Combine CDSOptions and AppCDSOptions test utility classes
• JDK-8293877: Rewrite MineField test
• JDK-8294193: Files.createDirectories throws FileAlreadyExistsException for a symbolic link whose target is an existing directory
• JDK-8294726: Update URLs in minefield tests
• JDK-8295239: Refactor java/util/Formatter/Basic script into a Java native test launcher
• JDK-8295344: Harden runtime/StackGuardPages/TestStackGuardPages.java
• JDK-8295859: Update Manual Test Groups
• JDK-8296709: WARNING: JNI call made without checking exceptions
• JDK-8296718:…

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 8 Fix Pack 40 (bsc#1236470):

• CVE-2025-21502: unauthenticated attacker can obtain unauthorized read and write access to data through the Hotspot component API (bsc#1236278).

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 8 Fix Pack 40 (bsc#1236470):

• CVE-2025-21502: unauthenticated attacker can obtain unauthorized read and write access to data through the Hotspot component API (bsc#1236278).

It was discovered that the Hotspot component of OpenJDK 11 did not properly handle API access under certain circumstances. An unauthenticated attacker could possibly use this issue to access unauthorized resources and expose sensitive information.

It was discovered that the Hotspot component of OpenJDK 17 did not properly handle API access under certain circumstances. An unauthenticated attacker could possibly use this issue to access unauthorized resources and expose sensitive information.

It was discovered that the Hotspot component of OpenJDK 21 did not properly handle API access under certain circumstances. An unauthenticated attacker could possibly use this issue to access unauthorized resources and expose sensitive information.