CVE-2026-22020
No scorePublic exploit
[updated libpng in Oracle Java]
What each source reports
OSVUBUNTU-CVE-2026-22020 No score
[updated libpng in Oracle Java]
- Record
UBUNTU-CVE-2026-22020- Updated
- 2026-11-10
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openjdk-9Ubuntu:16.04:LTS |
All versions, plus listed versions 9~b88-19~b101-2ubuntu29~b102-19~b113-0ubuntu19~b114-0ubuntu1 |
None known |
openjdk-13Ubuntu:20.04:LTS |
All versions, plus listed versions 13+33-113.0.1+9-213.0.2+8-113.0.2+8-213.0.3+3-1ubuntu213.0.4+8-1~20.0413.0.7+5-0ubuntu1~20.04 |
None known |
openjdk-16Ubuntu:20.04:LTS |
All versions, plus listed versions 16.0.1+9-1~20.04 |
None known |
openjdk-21Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 21.0.1+12-2~20.04.121.0.2+13-1~20.04.121.0.3+9-1ubuntu1~20.04.121.0.4+7-1ubuntu2~20.0421.0.5+11-1ubuntu1~20.04 Show 9 moreShow less21.0.6+7-1~20.04.121.0.7+6~us1-0ubuntu1~20.0421.0.8+9~us1-0ubuntu1~20.04.121.0.9+10-1~20.0421.0.10+7-1~20.0421.0.11+10-1~20.04.221.0.12+8-1~20.0421.0.12.1+1-1~20.04.421.0.13.0.3+1-1~20.04.1 |
None known |
openjdk-18Ubuntu:22.04:LTS |
All versions, plus listed versions 18~15ea-418~20ea-118~32ea-118~36ea-118.0.2+9-2~22.04 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | George0Papasotiriou/CVE-2026-22020-Weak-Seed-in-Quantum-Key-Distribution-Error-Correction | 2026-08-04 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-22020 is a vulnerability with no CVSS score yet in openjdk-9, published April 28, 2026. Public exploit code exists. No source names a fixed version.