CVE-2025-30761

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

The OpenJDK runtime environment.

Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive(CVE-2025-28162)

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.(CVE-2025-28164)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).(CVE-2025-30749)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2025-30754)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies…

The OpenJDK runtime environment.

Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive(CVE-2025-28162)

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.(CVE-2025-28164)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).(CVE-2025-30749)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2025-30754)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies…

The OpenJDK runtime environment.

Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive(CVE-2025-28162)

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.(CVE-2025-28164)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).(CVE-2025-30749)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2025-30754)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies…

The OpenJDK runtime environment.

Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive(CVE-2025-28162)

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.(CVE-2025-28164)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).(CVE-2025-30749)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2025-30754)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies…

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

• JDK: Better Glyph drawing (CVE-2025-30749)
• JDK: Enhance TLS protocol support (CVE-2025-30754)
• JDK: Improve scripting supports (CVE-2025-30761)
• JDK: Better Glyph drawing redux (CVE-2025-50106)

Bug Fix(es):

• On certain system configurations where the IPv4 stack was preferred over IPv6 (either due to -Djava.net.preferIPv4Stack=true being specified or no IPv6 interfaces being present), the method java.net.InetAddress.getLocalHost().getHostName() would return the fully qualified hostname instead of the short hostname. This behavior was only ever intended for Solaris systems and it deviated from the method's behavior for IPv6 interfaces. In this release, the method will return the short hostname on all interfaces. (Rocky Linux-102904, Rocky Linux-102905, Rocky Linux-102906, Rocky Linux-102907, Rocky Linux-102908, Rocky Linux-102909, Rocky Linux-102910, Rocky Linux-102911, Rocky Linux-102912)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

• JDK: Better Glyph drawing (CVE-2025-30749)
• JDK: Enhance TLS protocol support (CVE-2025-30754)
• JDK: Improve scripting supports (CVE-2025-30761)
• JDK: Better Glyph drawing redux (CVE-2025-50106)

Bug Fix(es):

• On certain system configurations where the IPv4 stack was preferred over IPv6 (either due to -Djava.net.preferIPv4Stack=true being specified or no IPv6 interfaces being present), the method java.net.InetAddress.getLocalHost().getHostName() would return the fully qualified hostname instead of the short hostname. This behavior was only ever intended for Solaris systems and it deviated from the method's behavior for IPv6 interfaces. In this release, the method will return the short hostname on all interfaces. (AlmaLinux-102904, AlmaLinux-102905, AlmaLinux-102906, AlmaLinux-102907, AlmaLinux-102908, AlmaLinux-102909, AlmaLinux-102910, AlmaLinux-102911, AlmaLinux-102912)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

• Upgrade to shenandoah-jdk8u462-b08 (GA) fixing the following CVEs:
• CVE-2025-30749: better Glyph drawing
• CVE-2025-30754: enhance TLS protocol support
• CVE-2025-30761: improve scripting supports
• CVE-2025-50106: glyph out-of-memory access and crash

• Upgrade to shenandoah-jdk8u462-b08 (GA) fixing the following CVEs:
• CVE-2025-30749: better Glyph drawing
• CVE-2025-30754: enhance TLS protocol support
• CVE-2025-30761: improve scripting supports
• CVE-2025-50106: glyph out-of-memory access and crash

• Upgrade to shenandoah-jdk8u462-b08 (GA) fixing the following CVEs:
• CVE-2025-30749: better Glyph drawing
• CVE-2025-30754: enhance TLS protocol support
• CVE-2025-30761: improve scripting supports
• CVE-2025-50106: glyph out-of-memory access and crash

• Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u462-b08 (GA). That fixes following CVEs:
• CVE-2025-30749: better Glyph drawing
• CVE-2025-30754: enhance TLS protocol support
• CVE-2025-30761: improve scripting supports
• CVE-2025-50106: glyph out-of-memory access and crash

• Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u462-b08 (GA). That fixes following CVEs:
• CVE-2025-30749: better Glyph drawing
• CVE-2025-30754: enhance TLS protocol support
• CVE-2025-30761: improve scripting supports
• CVE-2025-50106: glyph out-of-memory access and crash

• Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u462-b08 (GA). That fixes following CVEs:
• CVE-2025-30749: better Glyph drawing
• CVE-2025-30754: enhance TLS protocol support
• CVE-2025-30761: improve scripting supports
• CVE-2025-50106: glyph out-of-memory access and crash

• Update to shenandoah-jdk8u462-b08 (GA)
• Security fixes from OpenJDK 8u462-b08:
• CVE-2025-30749: fix 2D vulnerability allowing remote attackers to compromise JVM via network access
• CVE-2025-30754: fix JSSE vulnerability allowing unauthorized data access via TLS connections
• CVE-2025-30761: fix Scripting vulnerability allowing unauthorized data modification via network access
• CVE-2025-50106: fix 2D vulnerability allowing remote attackers to compromise JVM via API exploitation

• OpenJDK 11.0.28 release, build 6.
  • CVE-2025-30749: Java 2D heap corruption, code execution/DoS
  • CVE-2025-30754: JSSE TLS handshake flaw, weakened encryption
  • CVE-2025-30761: nashorn sandbox bypass, code execution
  • CVE-2025-50059: HTTP client header bug, data leak
  • CVE-2025-50106: Glyph rendering memory bug, crash/code exec
  • Release notes: https://mail.openjdk.org/pipermail/jdk-updates-dev/2025-July/045612.html

• Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u462-b08. That fixes following CVEs:
• CVE-2025-30749: better Glyph drawing
• CVE-2025-30754: enhance TLS protocol support
• CVE-2025-30761: improve scripting supports
• CVE-2025-50106: glyph out-of-memory access and crash

• Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u462-b08. That fixes following CVEs:
• CVE-2025-30749: better Glyph drawing
• CVE-2025-30754: enhance TLS protocol support
• CVE-2025-30761: improve scripting supports
• CVE-2025-50106: glyph out-of-memory access and crash

• OpenJDK 8u462 release
  • CVE-2025-30749: Java 2D heap corruption, code execution/DoS
  • CVE-2025-30754: JSSE TLS handshake flaw, weakened encryption
  • CVE-2025-30761: nashorn sandbox bypass, code execution
  • CVE-2025-50059: HTTP client header bug, data leak
  • CVE-2025-50106: Glyph rendering memory bug, crash/code exec
  • Release notes: https://mail.openjdk.org/pipermail/jdk8u-dev/2025-July/020263.html

• OpenJDK 8u462 release
  • CVE-2025-30749: Java 2D heap corruption, code execution/DoS
  • CVE-2025-30754: JSSE TLS handshake flaw, weakened encryption
  • CVE-2025-30761: nashorn sandbox bypass, code execution
  • CVE-2025-50059: HTTP client header bug, data leak
  • CVE-2025-50106: Glyph rendering memory bug, crash/code exec
  • Release notes: https://mail.openjdk.org/pipermail/jdk8u-dev/2025-July/020263.html

• Upgrade to openjdk-11.0.28+6 (GA).). The following CVEs were fixed:
• CVE-2025-30749: better Glyph drawing
• CVE-2025-30754: enhance TLS protocol support
• CVE-2025-30761: improve scripting supports
• CVE-2025-50059: improve HTTP client header handling
• CVE-2025-50106: better Glyph drawing redux

• OpenJDK 8u482 release, build 8. Release notes: https://mail.openjdk.org/pipermail/jdk8u-dev/2026-January/020959.html
  • Security fixes (8u482):
    • CVE-2026-21945: Prevent DoS via repeated crash or hang in sandbox security
    • CVE-2026-21932: Fix integrity issue in sandboxed handling of untrusted input
    • CVE-2026-21933: Prevent unauthorized data access or modification via networking APIs
    • CVE-2026-21925: Fix RMI flaw allowing unauthorized data read or modification
  • Previously fixed:
    • 8u472:
      • CVE-2025-53066: Prevent DoS or data exposure from untrusted input handling
      • CVE-2025-53057: Fix validation flaw affecting sandboxed networking/security logic
      • CVE-2025-61748: Prevent resource-consumption denial-of-service via crafted input
    • 8u462:
      • CVE-2025-30749: Fix security flaw enabling unauthorized actions or data exposure
      • CVE-2025-30754: Correct validation weakness affecting sandboxed execution integrity
      • CVE-2025-30761: Prevent unintended data access or via insufficient checks
      • CVE-2025-50106: Fix parsing weakness leading to potential denial-of-service
      • CVE-2025-50059: Fix improper HTTP header handling to prevent unintended requests

Better Glyph drawing. (CVE-2025-30749) Enhance TLS protocol support. (CVE-2025-30754) Improve scripting supports. (CVE-2025-30761) Improve HTTP client header handling. (CVE-2025-50059) Better Glyph drawing redux. (CVE-2025-50106)

These are all security issues fixed in the java-11-openjdk-11.0.28.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-24-openjdk-24.0.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-11-openj9-11.0.28.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-1_8_0-openj9-1.8.0.462-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.462-1.1 package on the GA media of openSUSE Tumbleweed.

This update for java-1_8_0-openj9 fixes the following issues:

Update to OpenJDK 8u462 build 08 with OpenJ9 0.53.0 virtual machine:

• CVE-2025-30749: several scenarios can lead to heap corruption (Oracle CPU 2025-07) (bsc#1246595)
• CVE-2025-30754: incomplete handshake may lead to weakening TLS protections (Oracle CPU 2025-07) (bsc#1246598)
• CVE-2025-30761: Improve scripting supports (Oracle CPU 2025-07) (bsc#1246580)
• CVE-2025-50059: Improve HTTP client header handling (Oracle CPU 2025-07) (bsc#1246575)

This update for java-11-openjdk fixes the following issues:

Upgrade to upstream tag jdk-11.0.28+6 (July 2025 CPU):

Security fixes:

• CVE-2025-30749: several scenarios can lead to heap corruption (bsc#1246595)
• CVE-2025-30754: incomplete handshake may lead to weakening TLS protections (bsc#1246598)
• CVE-2025-30761: Improve scripting supports (bsc#1246580)
• CVE-2025-50059: Improve HTTP client header handling (bsc#1246575)
• CVE-2025-50106: Glyph out-of-memory access and crash (bsc#1246584)

Changelog:

+ JDK-8026976: ECParameters, Point does not match field size
+ JDK-8211400: nsk.share.gc.Memory::getArrayLength returns wrong
  value
+ JDK-8231058: VerifyOops crashes with assert(_offset >= 0)
  failed: offset for non comment?
+ JDK-8232625: HttpClient redirect policy should be more
  conservative
+ JDK-8258483: [TESTBUG] gtest
  CollectorPolicy.young_scaled_initial_ergo_vm fails if heap is
  too small
+ JDK-8293345: SunPKCS11 provider checks on PKCS11 Mechanism are
  problematic
+ JDK-8296631: NSS tests failing on OL9 linux-aarch64 hosts
+ JDK-8301753: AppendFile/WriteFile has differences between make
  3.81 and 4+
+ JDK-8303770: Remove Baltimore root certificate expiring in May
  2025
+ JDK-8315380: AsyncGetCallTrace crash in frame::safe_for_sender
+ JDK-8327476: Upgrade JLine to 3.26.1
+ JDK-8328957: Update PKCS11Test.java to not use hardcoded path
+ JDK-8331959: Update PKCS#11 Cryptographic Token Interface to
  v3.1
+ JDK-8339300: CollectorPolicy.young_scaled_initial_ergo_vm
  gtest fails on ppc64 based platforms
+ JDK-8339728: [Accessibility,Windows,JAWS] Bug in the
  getKeyChar method of the AccessBridge class
+ JDK-8345133: Test sun/security/tools/jarsigner/
  /TsacertOptionTest.java failed: Warning found in stdout
+ JDK-8345625: Better HTTP connections
+ JDK-8346887: DrawFocusRect() may cause an assertion failure
+ JDK-8347629: Test FailOverDirectExecutionControlTest.java
  fails with -Xcomp
+ JDK-8348110: Update LCMS to 2.17
+ JDK-8348596: Update FreeType to 2.13.3
+ JDK-8348598: Update Libpng to 1.6.47
+ JDK-8348989: Better Glyph drawing
+ JDK-8349111: Enhance Swing supports
+ JDK-8349594: Enhance TLS protocol support
+ JDK-8350469: [11u] Test AbsPathsInImage.java fails
  - JDK-8239429 public clone
+ JDK-8350498: Remove two Camerfirma root CA certificates
+ JDK-8350991: Improve HTTP client header handling
+ JDK-8351099: Bump update version of OpenJDK: 11.0.28
+ JDK-8351422: Improve scripting supports
+ JDK-8352302: Test sun/security/tools/jarsigner/
  /TimestampCheck.java is failing
+ JDK-8352716: (tz) Update Timezone Data to 2025b
+ JDK-8356096: ISO 4217 Amendment 179 Update
+ JDK-8356571: Re-enable -Wtype-limits for GCC in LCMS
+ JDK-8359170: Add 2 TLS and 2 CS Sectigo roots
+ JDK-8360147: Better Glyph drawing redux

This update for java-11-openjdk fixes the following issues:

Upgrade to upstream tag jdk-11.0.28+6 (July 2025 CPU):

Security fixes:

• CVE-2025-30749: several scenarios can lead to heap corruption (bsc#1246595)
• CVE-2025-30754: incomplete handshake may lead to weakening TLS protections (bsc#1246598)
• CVE-2025-30761: Improve scripting supports (bsc#1246580)
• CVE-2025-50059: Improve HTTP client header handling (bsc#1246575)
• CVE-2025-50106: Glyph out-of-memory access and crash (bsc#1246584)

Changelog:

+ JDK-8026976: ECParameters, Point does not match field size
+ JDK-8211400: nsk.share.gc.Memory::getArrayLength returns wrong
  value
+ JDK-8231058: VerifyOops crashes with assert(_offset >= 0)
  failed: offset for non comment?
+ JDK-8232625: HttpClient redirect policy should be more
  conservative
+ JDK-8258483: [TESTBUG] gtest
  CollectorPolicy.young_scaled_initial_ergo_vm fails if heap is
  too small
+ JDK-8293345: SunPKCS11 provider checks on PKCS11 Mechanism are
  problematic
+ JDK-8296631: NSS tests failing on OL9 linux-aarch64 hosts
+ JDK-8301753: AppendFile/WriteFile has differences between make
  3.81 and 4+
+ JDK-8303770: Remove Baltimore root certificate expiring in May
  2025
+ JDK-8315380: AsyncGetCallTrace crash in frame::safe_for_sender
+ JDK-8327476: Upgrade JLine to 3.26.1
+ JDK-8328957: Update PKCS11Test.java to not use hardcoded path
+ JDK-8331959: Update PKCS#11 Cryptographic Token Interface to
  v3.1
+ JDK-8339300: CollectorPolicy.young_scaled_initial_ergo_vm
  gtest fails on ppc64 based platforms
+ JDK-8339728: [Accessibility,Windows,JAWS] Bug in the
  getKeyChar method of the AccessBridge class
+ JDK-8345133: Test sun/security/tools/jarsigner/
  /TsacertOptionTest.java failed: Warning found in stdout
+ JDK-8345625: Better HTTP connections
+ JDK-8346887: DrawFocusRect() may cause an assertion failure
+ JDK-8347629: Test FailOverDirectExecutionControlTest.java
  fails with -Xcomp
+ JDK-8348110: Update LCMS to 2.17
+ JDK-8348596: Update FreeType to 2.13.3
+ JDK-8348598: Update Libpng to 1.6.47
+ JDK-8348989: Better Glyph drawing
+ JDK-8349111: Enhance Swing supports
+ JDK-8349594: Enhance TLS protocol support
+ JDK-8350469: [11u] Test AbsPathsInImage.java fails
  - JDK-8239429 public clone
+ JDK-8350498: Remove two Camerfirma root CA certificates
+ JDK-8350991: Improve HTTP client header handling
+ JDK-8351099: Bump update version of OpenJDK: 11.0.28
+ JDK-8351422: Improve scripting supports
+ JDK-8352302: Test sun/security/tools/jarsigner/
  /TimestampCheck.java is failing
+ JDK-8352716: (tz) Update Timezone Data to 2025b
+ JDK-8356096: ISO 4217 Amendment 179 Update
+ JDK-8356571: Re-enable -Wtype-limits for GCC in LCMS
+ JDK-8359170: Add 2 TLS and 2 CS Sectigo roots
+ JDK-8360147: Better Glyph drawing redux

This update for java-1_8_0-openjdk fixes the following issues:

Update to version jdk8u462 (icedtea-3.36.0).

Security issues fixed:

• CVE-2025-30749: heap corruption allows unauthenticated attacker with network access to compromise and takeover Java applications that load and run untrusted code (bsc#1246595).
• CVE-2025-30754: incomplete handshake allows unauthenticated attacker with network access via TLS to gain unauthorized update, insert, delete and read access to sensitive data (bsc#1246598).
• CVE-2025-30761: issue in Scripting component allows unauthenticated attacker with network access to gain unauthorized creation, deletion or modification access to critical data (bsc#1246580).
• CVE-2025-50106: Glyph out-of-memory access allows unauthenticated attacker with network access to compromise and takeover Java applications that load and run untrusted code (bsc#1246584).

Other issues fixed:

• Import of OpenJDK 8 u462 build 08
  • JDK-8026976: ECParameters, Point does not match field size.
  • JDK-8071996: split_if accesses NULL region of ConstraintCast.
  • JDK-8186143: keytool -ext option doesn't accept wildcards for DNS subject alternative names.
  • JDK-8186787: clang-4.0 SIGSEGV in Unsafe_PutByte.
  • JDK-8248001: javadoc generates invalid HTML pages whose ftp:// links are broken.
  • JDK-8278472: Invalid value set to CANDIDATEFORM structure.
  • JDK-8293107: GHA: Bump to Ubuntu 22.04.
  • JDK-8303770: Remove Baltimore root certificate expiring in May 2025.
  • JDK-8309841: Jarsigner should print a warning if an entry is removed.
  • JDK-8339810: Clean up the code in sun.tools.jar.Main to properly close resources and use ZipFile during extract.
  • JDK-8345625: Better HTTP connections.
  • JDK-8346887: DrawFocusRect() may cause an assertion failure.
  • JDK-8349111: Enhance Swing supports.
  • JDK-8350498: Remove two Camerfirma root CA certificates.
  • JDK-8352716: (tz) Update Timezone Data to 2025b.
  • JDK-8353433: XCG currency code not recognized in JDK 8u.
  • JDK-8356096: ISO 4217 Amendment 179 Update.
  • JDK-8359170: Add 2 TLS and 2 CS Sectigo roots.
• Backports
  • JDK-8358538: Update GHA Windows runner to 2025.
• JDK-8354941: Build failure with glibc 2.42 due to uabs() name collision.

This update for java-1_8_0-openjdk fixes the following issues:

Update to version jdk8u462 (icedtea-3.36.0).

Security issues fixed:

• CVE-2025-30749: heap corruption allows unauthenticated attacker with network access to compromise and takeover Java applications that load and run untrusted code (bsc#1246595).
• CVE-2025-30754: incomplete handshake allows unauthenticated attacker with network access via TLS to gain unauthorized update, insert, delete and read access to sensitive data (bsc#1246598).
• CVE-2025-30761: issue in Scripting component allows unauthenticated attacker with network access to gain unauthorized creation, deletion or modification access to critical data (bsc#1246580).
• CVE-2025-50106: Glyph out-of-memory access allows unauthenticated attacker with network access to compromise and takeover Java applications that load and run untrusted code (bsc#1246584).

Other issues fixed:

• Import of OpenJDK 8 u462 build 08
  • JDK-8026976: ECParameters, Point does not match field size.
  • JDK-8071996: split_if accesses NULL region of ConstraintCast.
  • JDK-8186143: keytool -ext option doesn't accept wildcards for DNS subject alternative names.
  • JDK-8186787: clang-4.0 SIGSEGV in Unsafe_PutByte.
  • JDK-8248001: javadoc generates invalid HTML pages whose ftp:// links are broken.
  • JDK-8278472: Invalid value set to CANDIDATEFORM structure.
  • JDK-8293107: GHA: Bump to Ubuntu 22.04.
  • JDK-8303770: Remove Baltimore root certificate expiring in May 2025.
  • JDK-8309841: Jarsigner should print a warning if an entry is removed.
  • JDK-8339810: Clean up the code in sun.tools.jar.Main to properly close resources and use ZipFile during extract.
  • JDK-8345625: Better HTTP connections.
  • JDK-8346887: DrawFocusRect() may cause an assertion failure.
  • JDK-8349111: Enhance Swing supports.
  • JDK-8350498: Remove two Camerfirma root CA certificates.
  • JDK-8352716: (tz) Update Timezone Data to 2025b.
  • JDK-8353433: XCG currency code not recognized in JDK 8u.
  • JDK-8356096: ISO 4217 Amendment 179 Update.
  • JDK-8359170: Add 2 TLS and 2 CS Sectigo roots.
• Backports
  • JDK-8358538: Update GHA Windows runner to 2025.
• JDK-8354941: Build failure with glibc 2.42 due to uabs() name collision.

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 8 Fix Pack 50.

Security issues fixed:

• Oracle July 15 2025 CPU (bsc#1247754).
• CVE-2025-30749: heap corruption allows unauthenticated attacker with network access to compromise and takeover Java applications that load and run untrusted code (bsc#1246595).
• CVE-2025-30754: incomplete handshake allows unauthenticated attacker with network access via TLS to gain unauthorized update, insert, delete and read access to sensitive data (bsc#1246598).
• CVE-2025-30761: issue in the Scripting component allows unauthenticated attacker with network access to gain unauthorized creation, deletion or modification access to critical data (bsc#1246580).
• CVE-2025-50059: issue in the Networking component allows unauthenticated attacker with network access to gain unauthorized access to critical data (bsc#1246575).
• CVE-2025-50106: Glyph out-of-memory access allows unauthenticated attacker with network access to compromise and takeover Java applications that load and run untrusted code (bsc#1246584).

Other issues fixed.

• Class Libraries:
  • Oracle Security Fix 8348989: Better Glyph drawing.
  • Removal of Baltimore root certificate and TWO CAMERFIRMA root CA certificates from CACERTS.
  • Update timezone information to the latest TZDATA2025B.
• Java Virtual Machine:
  • Assertion failure at copyforwardscheme.cpp.
• JIT Compiler:
  • GC assert due to an invalid object reference.
  • SIGILL from JIT compiled method.
  • Unexpected behaviour with very large arrays.
• Security:
  • Deserialization of a serialized RSAPrivateCrtKey is throwing an exception.
  • EDDSAsignature fails when doing multiple update.
  • HTTPS channel binding support.
  • IBMJCEPlus provider supports post quantum cryptography algorithms ML-KEM (key encapsulation) and ML-DSA (digital signature).
  • Key certificate management: Extended key usage cannot be set without having key usage extension in certificate request.
  • MessageDigest.update API does not throw the correct exception.
  • Oracle Security Fix 8349594: Enhance TLS protocol support.
  • Problem getting key in PKCS12 keystore on MAC.
  • TLS support for the EDDSA signature algorithm.
  • Wrong algorithm name returned for EDDSA keys.
• z/OS Extentions:
  • IBMJCEHybridException with hybrid provider in GCM mode.

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 8 Fix Pack 50.

Security issues fixed:

• Oracle July 15 2025 CPU (bsc#1247754).
• CVE-2025-30749: heap corruption allows unauthenticated attacker with network access to compromise and takeover Java applications that load and run untrusted code (bsc#1246595).
• CVE-2025-30754: incomplete handshake allows unauthenticated attacker with network access via TLS to gain unauthorized update, insert, delete and read access to sensitive data (bsc#1246598).
• CVE-2025-30761: issue in the Scripting component allows unauthenticated attacker with network access to gain unauthorized creation, deletion or modification access to critical data (bsc#1246580).
• CVE-2025-50059: issue in the Networking component allows unauthenticated attacker with network access to gain unauthorized access to critical data (bsc#1246575).
• CVE-2025-50106: Glyph out-of-memory access allows unauthenticated attacker with network access to compromise and takeover Java applications that load and run untrusted code (bsc#1246584).

Other issues fixed:

• Class Libraries:
  • Oracle Security Fix 8348989: Better Glyph drawing.
  • Removal of Baltimore root certificate and TWO CAMERFIRMA root CA certificates from CACERTS.
  • Update timezone information to the latest TZDATA2025B.
• Java Virtual Machine:
  • Assertion failure at copyforwardscheme.cpp.
• JIT Compiler:
  • GC assert due to an invalid object reference.
  • SIGILL from JIT compiled method.
  • Unexpected behaviour with very large arrays.
• Security:
  • Deserialization of a serialized RSAPrivateCrtKey is throwing an exception.
  • EDDSAsignature fails when doing multiple update.
  • HTTPS channel binding support.
  • IBMJCEPlus provider supports post quantum cryptography algorithms ML-KEM (key encapsulation) and ML-DSA (digital signature).
  • Key certificate management: Extended key usage cannot be set without having key usage extension in certificate request.
  • MessageDigest.update API does not throw the correct exception.
  • Oracle Security Fix 8349594: Enhance TLS protocol support.
  • Problem getting key in PKCS12 keystore on MAC.
  • TLS support for the EDDSA signature algorithm.
  • Wrong algorithm name returned for EDDSA keys.
• z/OS Extentions:
  • IBMJCEHybridException with hybrid provider in GCM mode.

It was discovered that the 2D component of OpenJDK 8 did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2025-30749, CVE-2025-50106)

Mashroor Hasan Bhuiyan discovered that the JSSE component of OpenJDK 8 did not properly manage TLS 1.3 handshakes under certain circumstances. An attacker could possibly use this issue to obtain sensitive information. (CVE-2025-30754)

It was discovered that the Scripting component of OpenJDK 8 did not properly manage properties under certain circumstances. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. (CVE-2025-30761)

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2025-07-15

It was discovered that the 2D component of OpenJDK 11 did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2025-30749, CVE-2025-50106)

VMashroor Hasan Bhuiyan discovered that the JSSE component of OpenJDK 11 did not properly manage TLS 1.3 handshakes under certain circumstances. An attacker could possibly use this issue to obtain sensitive information. (CVE-2025-30754)

Martin van Wingerden and Violeta Georgieva of Broadcom discovered that the Networking component of OpenJDK 11 did not properly manage network connections under certain circumstances. An attacker could possibly use this issue to obtain sensitive information. (CVE-2025-50059)

It was discovered that the Scripting component of OpenJDK 11 did not properly manage properties under certain circumstances. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. (CVE-2025-30761)

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following link for more information: https://openjdk.org/groups/vulnerability/advisories/2025-07-15