CVE-2026-47027

Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2026-21925)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).(CVE-2026-21932)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or…

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2026-21925)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).(CVE-2026-21932)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or…

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.(CVE-2025-53057)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).(CVE-2025-53066)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2026-21925)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with…

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2026-21925)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).(CVE-2026-21932)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or…

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2026-21925)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).(CVE-2026-21932)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or…

The OpenJDK runtime environment.

Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive(CVE-2025-28162)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.(CVE-2025-53057)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).(CVE-2025-53066)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2025-61748)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition:…

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

• JDK: Enhance TLS certificate handling (CVE-2026-46968)

• JDK: Improve DTLS handshaking (CVE-2026-46917)

• JDK: Enhance JPEG handling (CVE-2026-47010)

• JDK: Enhance XBM image support (CVE-2026-47021)

• JDK: Enhance Jar file processing (CVE-2026-47027)

• JDK: Improve certification checking (CVE-2026-60147)

• JDK: Enhance AWT ImagingLib (CVE-2026-47059)

• JDK: Enhance Jar handling (CVE-2026-47063)

• JDK: Update LCMS to 2.19 (CVE-2026-41254)

Enhancement(s):

• For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (Rocky Linux-212474, Rocky Linux-212475, Rocky Linux-212476, Rocky Linux-212477, Rocky Linux-212478, Rocky Linux-212479, Rocky Linux-212480, Rocky Linux-212481)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit.

Security Fix(es):

• JDK: Enhance TLS certificate handling (CVE-2026-46968)

• JDK: Improve DTLS handshaking (CVE-2026-46917)

• JDK: Enhance JPEG handling (CVE-2026-47010)

• JDK: Enhance XBM image support (CVE-2026-47021)

• JDK: Enhance Jar file processing (CVE-2026-47027)

• JDK: Improve certification checking (CVE-2026-60147)

• JDK: Enhance AWT ImagingLib (CVE-2026-47059)

• JDK: Enhance Jar handling (CVE-2026-47063)

• JDK: Update LCMS to 2.19 (CVE-2026-41254)

Enhancement(s):

• For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (Rocky Linux-211046, Rocky Linux-211048)

Bug Fix(es):

• The performance of the Math.pow function regressed between OpenJDK 8 and OpenJDK 11. This was due to an absence of constant folding when applicable (for example, Math.pow(2,1) being replaced by 2). This release reintroduces this optimization. (Rocky Linux-211050, Rocky Linux-211052)
• On Rocky Linux 9 systems, the alternatives list a JDK and architecture pair (for example, "java-11-openjdk.x86_64") followed by the path to the binary in brackets. Rocky Linux 10 systems have a simpler format that just lists the path. Because the OpenJDK 25 packages for Rocky Linux 9 were originally based on those from Rocky Linux 10, they used the simpler format. With this release, the format for OpenJDK 25 packages on Rocky Linux 9 is updated to be closer to other JDKs on that platform. (Rocky Linux-212650)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

• JDK: Enhance TLS certificate handling (CVE-2026-46968)
• JDK: Enhance JPEG handling (CVE-2026-47010)
• JDK: Enhance XBM image support (CVE-2026-47021)
• JDK: Enhance Jar file processing (CVE-2026-47027)
• JDK: Improve certification checking (CVE-2026-60147)
• JDK: Enhance AWT ImagingLib (CVE-2026-47059)
• JDK: Enhance Jar handling (CVE-2026-47063)
• JDK: Improve Nashorn index handling (CVE-2026-47057)
• JDK: Enhance Dataview Implementation (CVE-2026-47058)
• JDK: Update LCMS to 2.19 (CVE-2026-41254)

Enhancement(s):

• For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212308, AlmaLinux-212309, AlmaLinux-212310, AlmaLinux-212311, AlmaLinux-212312, AlmaLinux-212313, AlmaLinux-212314, AlmaLinux-212315)

Bug Fix(es):

• In previous releases, the RPM did not correctly own the subdirectories used for documentation in /usr/share/doc and /usr/share/javadoc. This is fixed in this release, so these subdirectories will be removed when the package is uninstalled. (AlmaLinux-212319, AlmaLinux-212320, AlmaLinux-212321, AlmaLinux-212322, AlmaLinux-212323, AlmaLinux-212324, AlmaLinux-212325, AlmaLinux-212326)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

• JDK: Enhance TLS certificate handling (CVE-2026-46968)
• JDK: Improve DTLS handshaking (CVE-2026-46917)
• JDK: Enhance JPEG handling (CVE-2026-47010)
• JDK: Enhance XBM image support (CVE-2026-47021)
• JDK: Enhance Jar file processing (CVE-2026-47027)
• JDK: Improve certification checking (CVE-2026-60147)
• JDK: Enhance AWT ImagingLib (CVE-2026-47059)
• JDK: Enhance Jar handling (CVE-2026-47063)
• JDK: Update LCMS to 2.19 (CVE-2026-41254)

Enhancement(s):

• For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212474, AlmaLinux-212475, AlmaLinux-212476, AlmaLinux-212477, AlmaLinux-212478, AlmaLinux-212479, AlmaLinux-212480, AlmaLinux-212481)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.

Security Fix(es):

• JDK: Enhance TLS certificate handling (CVE-2026-46968)
• JDK: Improve DTLS handshaking (CVE-2026-46917)
• JDK: Enhance JPEG handling (CVE-2026-47010)
• JDK: Enhance XBM image support (CVE-2026-47021)
• JDK: Enhance Jar file processing (CVE-2026-47027)
• JDK: Improve certification checking (CVE-2026-60147)
• JDK: Enhance AWT ImagingLib (CVE-2026-47059)
• JDK: Enhance Jar handling (CVE-2026-47063)
• JDK: Update LCMS to 2.19 (CVE-2026-41254)

Enhancement(s):

• For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212337, AlmaLinux-212338, AlmaLinux-212339, AlmaLinux-212340, AlmaLinux-212342, AlmaLinux-212343)

Bug Fix(es):

• In previous releases, the RPM did not correctly own the subdirectories used for documentation in /usr/share/doc and /usr/share/javadoc. This is fixed in this release, so these subdirectories will be removed when the package is uninstalled. (AlmaLinux-212353, AlmaLinux-212359, AlmaLinux-212360, AlmaLinux-212361)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit.

Security Fix(es):

• JDK: Enhance TLS certificate handling (CVE-2026-46968)
• JDK: Improve DTLS handshaking (CVE-2026-46917)
• JDK: Enhance JPEG handling (CVE-2026-47010)
• JDK: Enhance XBM image support (CVE-2026-47021)
• JDK: Enhance Jar file processing (CVE-2026-47027)
• JDK: Improve certification checking (CVE-2026-60147)
• JDK: Enhance AWT ImagingLib (CVE-2026-47059)
• JDK: Enhance Jar handling (CVE-2026-47063)
• JDK: Update LCMS to 2.19 (CVE-2026-41254)

Enhancement(s):

• For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-211046, AlmaLinux-211048)

Bug Fix(es):

• The performance of the Math.pow function regressed between OpenJDK 8 and OpenJDK 11. This was due to an absence of constant folding when applicable (for example, Math.pow(2,1) being replaced by 2). This release reintroduces this optimization. (AlmaLinux-211050, AlmaLinux-211052)
• On AlmaLinux 9 systems, the alternatives list a JDK and architecture pair (for example, "java-11-openjdk.x86_64") followed by the path to the binary in brackets. AlmaLinux 10 systems have a simpler format that just lists the path. Because the OpenJDK 25 packages for AlmaLinux 9 were originally based on those from AlmaLinux 10, they used the simpler format. With this release, the format for OpenJDK 25 packages on AlmaLinux 9 is updated to be closer to other JDKs on that platform. (AlmaLinux-212650)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

• Update to shenandoah-jdk8u502-b07
• Security fixes from OpenJDK 8u502-b07:
  • CVE-2026-47057: improve Nashorn index handling
  • CVE-2026-47063: enhance jar handling
  • CVE-2026-47058: enhance DataView implementation
  • CVE-2026-47027: enhance jar file processing
  • CVE-2026-47021: enhance XBM image support
  • CVE-2026-60147: improve certification checking
  • CVE-2026-46968: enhance TLS certificate handling
  • CVE-2026-47059: enhance AWT ImagingLib
  • CVE-2026-47010: enhance JPEG handling

• Update to shenandoah-jdk8u502-b07
• Security fixes from OpenJDK 8u502-b07:
  • CVE-2026-47057: improve Nashorn index handling
  • CVE-2026-47063: enhance jar handling
  • CVE-2026-47058: enhance DataView implementation
  • CVE-2026-47027: enhance jar file processing
  • CVE-2026-47021: enhance XBM image support
  • CVE-2026-60147: improve certification checking
  • CVE-2026-46968: enhance TLS certificate handling
  • CVE-2026-47059: enhance AWT ImagingLib
  • CVE-2026-47010: enhance JPEG handling

• Update to shenandoah-jdk8u502-b07
• Security fixes from OpenJDK 8u502-b07:
  • CVE-2026-47057: improve Nashorn index handling
  • CVE-2026-47063: enhance jar handling
  • CVE-2026-47058: enhance DataView implementation
  • CVE-2026-47027: enhance jar file processing
  • CVE-2026-47021: enhance XBM image support
  • CVE-2026-60147: improve certification checking
  • CVE-2026-46968: enhance TLS certificate handling
  • CVE-2026-47059: enhance AWT ImagingLib
  • CVE-2026-47010: enhance JPEG handling

• Upgrade to openjdk-11.0.32+9 (GA). The following CVEs were fixed:
• CVE-2026-47063: enhance jar handling
• CVE-2026-46917: improve DTLS handshaking
• CVE-2026-47027: enhance jar file processing
• CVE-2026-47021: enhance XBM image support
• CVE-2026-60147: improve certification checking
• CVE-2026-46968: enhance TLS certificate handling
• CVE-2026-47010: enhance JPEG handling
• CVE-2026-47059: enhance AWT ImagingLib
• CVE-2026-47057: improve Nashorn index handling
• CVE-2026-47058: enhance DataView implementation
• Rebase FIPS patch from the rh-openjdk fips branch (06df8f9bd4) for 11.0.32

• Update to shenandoah-jdk8u502-b07
• Security fixes from OpenJDK 8u502-b07:
  • CVE-2026-47057: improve Nashorn index handling
  • CVE-2026-47063: enhance jar handling
  • CVE-2026-47058: enhance DataView implementation
  • CVE-2026-47027: enhance jar file processing
  • CVE-2026-47021: enhance XBM image support
  • CVE-2026-60147: improve certification checking
  • CVE-2026-46968: enhance TLS certificate handling
  • CVE-2026-47059: enhance AWT ImagingLib
  • CVE-2026-47010: enhance JPEG handling

• Update to jdk-17.0.20+8 (GA)
• CVE-2026-41254: fix integer overflow in the bundled Little CMS CubeSize function that could lead to information disclosure or denial of service when processing crafted colour profiles (bundled LCMS updated to 2.19.1)
• CVE-2026-46917: improve DTLS handshaking
• CVE-2026-46968: enhance TLS certificate handling
• CVE-2026-47010: enhance JPEG handling
• CVE-2026-47021: enhance XBM image support
• CVE-2026-47027: enhance Jar file processing
• CVE-2026-47059: enhance AWT ImagingLib
• CVE-2026-47063: enhance Jar handling
• CVE-2026-60147: improve certification checking

• Update to jdk-21.0.12+8 (GA)
• CVE-2026-41254: Little CMS integer overflow in CubeSize (bundled LCMS updated to 2.19.1)
• CVE-2026-46917: Improve DTLS handshaking
• CVE-2026-46968: Enhance TLS certificate handling
• CVE-2026-47010: Enhance JPEG handling
• CVE-2026-47021: Enhance XBM image support
• CVE-2026-47027: Enhance Jar file processing
• CVE-2026-47059: Enhance AWT ImagingLib
• CVE-2026-47063: Enhance Jar handling
• CVE-2026-60147: Improve certification checking

• Upgrade to openjdk-11.0.32+9 (GA). The following CVEs were fixed:
• CVE-2026-47063: enhance jar handling
• CVE-2026-46917: improve DTLS handshaking
• CVE-2026-47027: enhance jar file processing
• CVE-2026-47021: enhance XBM image support
• CVE-2026-60147: improve certification checking
• CVE-2026-46968: enhance TLS certificate handling
• CVE-2026-47010: enhance JPEG handling
• CVE-2026-47059: enhance AWT ImagingLib
• CVE-2026-47057: improve Nashorn index handling
• CVE-2026-47058: enhance DataView implementation
• Rebase FIPS patch from the rh-openjdk fips branch (06df8f9bd4) for 11.0.32

• Upgrade to openjdk-11.0.32+9 (GA). The following CVEs were fixed:
• CVE-2026-47063: enhance jar handling
• CVE-2026-46917: improve DTLS handshaking
• CVE-2026-47027: enhance jar file processing
• CVE-2026-47021: enhance XBM image support
• CVE-2026-60147: improve certification checking
• CVE-2026-46968: enhance TLS certificate handling
• CVE-2026-47010: enhance JPEG handling
• CVE-2026-47059: enhance AWT ImagingLib
• CVE-2026-47057: improve Nashorn index handling
• CVE-2026-47058: enhance DataView implementation
• Rebase FIPS patch from the rh-openjdk fips branch (06df8f9bd4) for 11.0.32

• Update to jdk-17.0.20+8 (GA)
• CVE-2026-41254: Little CMS integer overflow in CubeSize (bundled LCMS updated to 2.19.1)
• CVE-2026-46917: Improve DTLS handshaking
• CVE-2026-46968: Enhance TLS certificate handling
• CVE-2026-47010: Enhance JPEG handling
• CVE-2026-47021: Enhance XBM image support
• CVE-2026-47027: Enhance Jar file processing
• CVE-2026-47059: Enhance AWT ImagingLib
• CVE-2026-47063: Enhance Jar handling
• CVE-2026-60147: Improve certification checking

• Update to shenandoah-jdk8u502-b07
• Security fixes from OpenJDK 8u502-b07:
  • CVE-2026-41254: update LittleCMS to 2.19.1
  • CVE-2026-47057: improve Nashorn index handling
  • CVE-2026-47063: enhance jar handling
  • CVE-2026-47058: enhance DataView implementation
  • CVE-2026-47027: enhance jar file processing
  • CVE-2026-47021: enhance XBM image support
  • CVE-2026-60147: improve certification checking
  • CVE-2026-46968: enhance TLS certificate handling
  • CVE-2026-47059: enhance AWT ImagingLib
  • CVE-2026-47010: enhance JPEG handling

• OpenJDK 8u502 release
  • CVE-2026-41254: 2D component
  • CVE-2026-46968: JSSE component
  • CVE-2026-47010: ImageIO component
  • CVE-2026-47021: 2D component
  • CVE-2026-47027: Security component
  • CVE-2026-47057: Scripting component, improve Nashorn index handling
  • CVE-2026-47058: Scripting component, enhance DataView implementation
  • CVE-2026-47059: 2D component
  • CVE-2026-47063: Security component, enhance Jar handling
  • CVE-2026-60147: Security component
  • Release notes: https://mail.openjdk.org/pipermail/jdk8u-dev/2026-July/thread.html
• d/p/zero-sh.diff: Refresh patch.

• OpenJDK 8u502 release
  • CVE-2026-41254: 2D component
  • CVE-2026-46968: JSSE component
  • CVE-2026-47010: ImageIO component
  • CVE-2026-47021: 2D component
  • CVE-2026-47027: Security component
  • CVE-2026-47057: Scripting component, improve Nashorn index handling
  • CVE-2026-47058: Scripting component, enhance DataView implementation
  • CVE-2026-47059: 2D component
  • CVE-2026-47063: Security component, enhance Jar handling
  • CVE-2026-60147: Security component
  • Release notes: https://mail.openjdk.org/pipermail/jdk8u-dev/2026-July/thread.html
• d/p/zero-sh.diff: Refresh patch.

• OpenJDK 8u502 release, build 7 (Oracle July 2026 CPU). Release notes: https://openjdk.org/groups/vulnerability/advisories/2026-07-21
  • Security fixes (8u502):
    • CVE-2026-41254: 2D integer overflow in Little CMS CubeSize
    • CVE-2026-46968: JSSE TLS certificate handling
    • CVE-2026-47010: ImageIO JPEG handling
    • CVE-2026-47021: 2D XBM image support
    • CVE-2026-47027: Security Jar file processing
    • CVE-2026-47057: Scripting Nashorn index handling
    • CVE-2026-47058: Scripting DataView implementation
    • CVE-2026-47059: 2D AWT ImagingLib
    • CVE-2026-47063: Security Jar handling
    • CVE-2026-60147: Security certification checking (CVE-2026-46917 from the same advisory does not affect the 8u train per the OpenJDK 2026-07-21 risk matrix.)
• debian/rules: bump gh_tag to jdk8u502-ga, version_dash_buildnr to 502-b07, gh_tag_aarch32 to jdk8u502-b06-aarch32-20260710.
• Refresh orig tarball from Ubuntu archive (openjdk-8_8u502-gaus1.orig.tar.gz, sha1 553d02f135b9c68cf95a2daf0e5db367e4e0569b, size 67975803 bytes; source: archive.ubuntu.com openjdk-8 8u502-gaus1).
• Refresh Ubuntu quilt patches for u502 context:
  • zero-sh.diff (upstream added a RISCV branch to os::dll_load; the ZERO_SH branch and #error list are re-anchored after it)
  • gcc14.diff (upstream adopted the UINT8** freeArray signature in imageioJPEG.c, so that hunk is dropped; parse_manifest.c retained) All 48 quilt patches apply cleanly (0 rejects).
• Ref: ELSCVE-167684, ELSCVE-167634, ELSCVE-167656

• OpenJDK 11.0.32 release, build 9.
  • CVE-2026-41254: 2D component, fix integer overflow in Little CMS CubeSize
  • CVE-2026-46917: JSSE component, improve DTLS handshaking
  • CVE-2026-46968: JSSE component, enhance TLS certificate handling
  • CVE-2026-47010: ImageIO component, enhance JPEG handling
  • CVE-2026-47021: 2D component, enhance XBM image support
  • CVE-2026-47027: Security component, enhance Jar file processing
  • CVE-2026-47057: Scripting component, improve Nashorn index handling
  • CVE-2026-47058: Scripting component, enhance DataView implementation
  • CVE-2026-47059: 2D component, enhance AWT ImagingLib
  • CVE-2026-47063: Security component, enhance Jar handling
  • CVE-2026-60147: Security component, improve certification checking
  • OpenJDK vulnerability advisory: https://openjdk.org/groups/vulnerability/advisories/2026-07-21
• Refresh debian/patches/libpcsclite-dlopen.diff against the upstream macOS Big Sur dynamic linker cache changes in PlatformPCSC.java.

• OpenJDK 11.0.32 release, build 9.
  • CVE-2026-41254: 2D component
  • CVE-2026-46917: JSSE component
  • CVE-2026-46968: JSSE component
  • CVE-2026-47010: ImageIO component
  • CVE-2026-47021: 2D component
  • CVE-2026-47027: Security component
  • CVE-2026-47057: Scripting component, improve Nashorn index handling
  • CVE-2026-47058: Scripting component, enhance DataView implementation
  • CVE-2026-47059: 2D component
  • CVE-2026-47063: Security component, enhance Jar handling
  • CVE-2026-60147: Security component
  • OpenJDK vulnerability advisory: https://openjdk.org/groups/vulnerability/advisories/2026-07-21
• d/p/libpcsclite-dlopen.diff: Refresh patch.

• Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u502-b07. That fixes following CVEs:
• CVE-2026-46968: JSSE, remote high-complexity integrity flaw in TLS certificate handling
• CVE-2026-47010: ImageIO, remote high-complexity low-impact integrity flaw in JPEG handling
• CVE-2026-47021: 2D, remote unauth partial DoS via XBM image support
• CVE-2026-47027: Libraries, remote unauth partial DoS in Jar file processing
• CVE-2026-47057: Scripting, remote unauth DoS via Nashorn index handling
• CVE-2026-47058: Scripting, remote high-complexity high-confidentiality and high-integrity flaw in Dataview implementation
• CVE-2026-47059: 2D, remote high-complexity low-impact partial DoS in AWT ImagingLib
• CVE-2026-47063: Libraries, remote unauth high-integrity flaw in Jar handling
• CVE-2026-60147: Security, remote unauth low-impact flaw in certification checking
• CVE-2026-41254: Little CMS information disclosure / DoS, fixed by the in-tree LCMS bump to 2.19.1 (this build uses --with-lcms=bundled since RHEL 6 has no lcms2)

• Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u502-b07. That fixes following CVEs:
• CVE-2026-46968: JSSE, remote high-complexity integrity flaw in TLS certificate handling
• CVE-2026-47010: ImageIO, remote high-complexity low-impact integrity flaw in JPEG handling
• CVE-2026-47021: 2D, remote unauth partial DoS via XBM image support
• CVE-2026-47027: Libraries, remote unauth partial DoS in Jar file processing
• CVE-2026-47057: Scripting, remote unauth DoS via Nashorn index handling
• CVE-2026-47058: Scripting, remote high-complexity high-confidentiality and high-integrity flaw in Dataview implementation
• CVE-2026-47059: 2D, remote high-complexity low-impact partial DoS in AWT ImagingLib
• CVE-2026-47063: Libraries, remote unauth high-integrity flaw in Jar handling
• CVE-2026-60147: Security, remote unauth low-impact flaw in certification checking
• CVE-2026-41254: Little CMS information disclosure / DoS, fixed by the in-tree LCMS bump to 2.19.1 (this build uses --with-lcms=bundled since RHEL 6 has no lcms2)

• Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u502-b07 (GA). That fixes following CVEs:
• CVE-2026-46968: JSSE, remote high-complexity high-integrity compromise via TLS (enhance TLS certificate handling)
• CVE-2026-47010: ImageIO, remote high-complexity low-impact integrity compromise (enhance JPEG handling)
• CVE-2026-47021: 2D, remote unauthenticated DoS with low availability impact (enhance XBM image support)
• CVE-2026-47057: Scripting, improve Nashorn index handling
• CVE-2026-47058: Scripting, enhance DataView implementation
• CVE-2026-47063: Libraries, enhance Jar handling
• The same upstream release also closes the remaining CVEs of the Oracle July 2026 CPU, tracked under separate ELS tickets:
• CVE-2026-47027: Libraries, enhance Jar file processing
• CVE-2026-47059: 2D, enhance AWT ImagingLib
• CVE-2026-60147: Security, improve certification checking
• CVE-2026-41254: bundled Little CMS updated to 2.19.1