CVE-2026-47057

Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

The OpenJDK runtime environment.

Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive(CVE-2025-28162)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.(CVE-2025-53057)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).(CVE-2025-53066)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2025-61748)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition:…

Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es):

• JDK: Enhance TLS certificate handling (CVE-2026-46968)
• JDK: Enhance JPEG handling (CVE-2026-47010)
• JDK: Enhance XBM image support (CVE-2026-47021)
• JDK: Enhance Jar file processing (CVE-2026-47027)
• JDK: Improve certification checking (CVE-2026-60147)
• JDK: Enhance AWT ImagingLib (CVE-2026-47059)
• JDK: Enhance Jar handling (CVE-2026-47063)
• JDK: Improve Nashorn index handling (CVE-2026-47057)
• JDK: Enhance Dataview Implementation (CVE-2026-47058)
• JDK: Update LCMS to 2.19 (CVE-2026-41254)

Enhancement(s):

• For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212308, AlmaLinux-212309, AlmaLinux-212310, AlmaLinux-212311, AlmaLinux-212312, AlmaLinux-212313, AlmaLinux-212314, AlmaLinux-212315)

Bug Fix(es):

• In previous releases, the RPM did not correctly own the subdirectories used for documentation in /usr/share/doc and /usr/share/javadoc. This is fixed in this release, so these subdirectories will be removed when the package is uninstalled. (AlmaLinux-212319, AlmaLinux-212320, AlmaLinux-212321, AlmaLinux-212322, AlmaLinux-212323, AlmaLinux-212324, AlmaLinux-212325, AlmaLinux-212326)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

• Update to shenandoah-jdk8u502-b07
• Security fixes from OpenJDK 8u502-b07:
  • CVE-2026-47057: improve Nashorn index handling
  • CVE-2026-47063: enhance jar handling
  • CVE-2026-47058: enhance DataView implementation
  • CVE-2026-47027: enhance jar file processing
  • CVE-2026-47021: enhance XBM image support
  • CVE-2026-60147: improve certification checking
  • CVE-2026-46968: enhance TLS certificate handling
  • CVE-2026-47059: enhance AWT ImagingLib
  • CVE-2026-47010: enhance JPEG handling

• Update to shenandoah-jdk8u502-b07
• Security fixes from OpenJDK 8u502-b07:
  • CVE-2026-47057: improve Nashorn index handling
  • CVE-2026-47063: enhance jar handling
  • CVE-2026-47058: enhance DataView implementation
  • CVE-2026-47027: enhance jar file processing
  • CVE-2026-47021: enhance XBM image support
  • CVE-2026-60147: improve certification checking
  • CVE-2026-46968: enhance TLS certificate handling
  • CVE-2026-47059: enhance AWT ImagingLib
  • CVE-2026-47010: enhance JPEG handling

• Update to shenandoah-jdk8u502-b07
• Security fixes from OpenJDK 8u502-b07:
  • CVE-2026-47057: improve Nashorn index handling
  • CVE-2026-47063: enhance jar handling
  • CVE-2026-47058: enhance DataView implementation
  • CVE-2026-47027: enhance jar file processing
  • CVE-2026-47021: enhance XBM image support
  • CVE-2026-60147: improve certification checking
  • CVE-2026-46968: enhance TLS certificate handling
  • CVE-2026-47059: enhance AWT ImagingLib
  • CVE-2026-47010: enhance JPEG handling

• Upgrade to openjdk-11.0.32+9 (GA). The following CVEs were fixed:
• CVE-2026-47063: enhance jar handling
• CVE-2026-46917: improve DTLS handshaking
• CVE-2026-47027: enhance jar file processing
• CVE-2026-47021: enhance XBM image support
• CVE-2026-60147: improve certification checking
• CVE-2026-46968: enhance TLS certificate handling
• CVE-2026-47010: enhance JPEG handling
• CVE-2026-47059: enhance AWT ImagingLib
• CVE-2026-47057: improve Nashorn index handling
• CVE-2026-47058: enhance DataView implementation
• Rebase FIPS patch from the rh-openjdk fips branch (06df8f9bd4) for 11.0.32

• Update to shenandoah-jdk8u502-b07
• Security fixes from OpenJDK 8u502-b07:
  • CVE-2026-47057: improve Nashorn index handling
  • CVE-2026-47063: enhance jar handling
  • CVE-2026-47058: enhance DataView implementation
  • CVE-2026-47027: enhance jar file processing
  • CVE-2026-47021: enhance XBM image support
  • CVE-2026-60147: improve certification checking
  • CVE-2026-46968: enhance TLS certificate handling
  • CVE-2026-47059: enhance AWT ImagingLib
  • CVE-2026-47010: enhance JPEG handling

• Upgrade to openjdk-11.0.32+9 (GA). The following CVEs were fixed:
• CVE-2026-47063: enhance jar handling
• CVE-2026-46917: improve DTLS handshaking
• CVE-2026-47027: enhance jar file processing
• CVE-2026-47021: enhance XBM image support
• CVE-2026-60147: improve certification checking
• CVE-2026-46968: enhance TLS certificate handling
• CVE-2026-47010: enhance JPEG handling
• CVE-2026-47059: enhance AWT ImagingLib
• CVE-2026-47057: improve Nashorn index handling
• CVE-2026-47058: enhance DataView implementation
• Rebase FIPS patch from the rh-openjdk fips branch (06df8f9bd4) for 11.0.32

• Upgrade to openjdk-11.0.32+9 (GA). The following CVEs were fixed:
• CVE-2026-47063: enhance jar handling
• CVE-2026-46917: improve DTLS handshaking
• CVE-2026-47027: enhance jar file processing
• CVE-2026-47021: enhance XBM image support
• CVE-2026-60147: improve certification checking
• CVE-2026-46968: enhance TLS certificate handling
• CVE-2026-47010: enhance JPEG handling
• CVE-2026-47059: enhance AWT ImagingLib
• CVE-2026-47057: improve Nashorn index handling
• CVE-2026-47058: enhance DataView implementation
• Rebase FIPS patch from the rh-openjdk fips branch (06df8f9bd4) for 11.0.32

• Update to shenandoah-jdk8u502-b07
• Security fixes from OpenJDK 8u502-b07:
  • CVE-2026-41254: update LittleCMS to 2.19.1
  • CVE-2026-47057: improve Nashorn index handling
  • CVE-2026-47063: enhance jar handling
  • CVE-2026-47058: enhance DataView implementation
  • CVE-2026-47027: enhance jar file processing
  • CVE-2026-47021: enhance XBM image support
  • CVE-2026-60147: improve certification checking
  • CVE-2026-46968: enhance TLS certificate handling
  • CVE-2026-47059: enhance AWT ImagingLib
  • CVE-2026-47010: enhance JPEG handling

• OpenJDK 8u502 release
  • CVE-2026-41254: 2D component
  • CVE-2026-46968: JSSE component
  • CVE-2026-47010: ImageIO component
  • CVE-2026-47021: 2D component
  • CVE-2026-47027: Security component
  • CVE-2026-47057: Scripting component, improve Nashorn index handling
  • CVE-2026-47058: Scripting component, enhance DataView implementation
  • CVE-2026-47059: 2D component
  • CVE-2026-47063: Security component, enhance Jar handling
  • CVE-2026-60147: Security component
  • Release notes: https://mail.openjdk.org/pipermail/jdk8u-dev/2026-July/thread.html
• d/p/zero-sh.diff: Refresh patch.

• OpenJDK 8u502 release
  • CVE-2026-41254: 2D component
  • CVE-2026-46968: JSSE component
  • CVE-2026-47010: ImageIO component
  • CVE-2026-47021: 2D component
  • CVE-2026-47027: Security component
  • CVE-2026-47057: Scripting component, improve Nashorn index handling
  • CVE-2026-47058: Scripting component, enhance DataView implementation
  • CVE-2026-47059: 2D component
  • CVE-2026-47063: Security component, enhance Jar handling
  • CVE-2026-60147: Security component
  • Release notes: https://mail.openjdk.org/pipermail/jdk8u-dev/2026-July/thread.html
• d/p/zero-sh.diff: Refresh patch.

• OpenJDK 8u502 release, build 7 (Oracle July 2026 CPU). Release notes: https://openjdk.org/groups/vulnerability/advisories/2026-07-21
  • Security fixes (8u502):
    • CVE-2026-41254: 2D integer overflow in Little CMS CubeSize
    • CVE-2026-46968: JSSE TLS certificate handling
    • CVE-2026-47010: ImageIO JPEG handling
    • CVE-2026-47021: 2D XBM image support
    • CVE-2026-47027: Security Jar file processing
    • CVE-2026-47057: Scripting Nashorn index handling
    • CVE-2026-47058: Scripting DataView implementation
    • CVE-2026-47059: 2D AWT ImagingLib
    • CVE-2026-47063: Security Jar handling
    • CVE-2026-60147: Security certification checking (CVE-2026-46917 from the same advisory does not affect the 8u train per the OpenJDK 2026-07-21 risk matrix.)
• debian/rules: bump gh_tag to jdk8u502-ga, version_dash_buildnr to 502-b07, gh_tag_aarch32 to jdk8u502-b06-aarch32-20260710.
• Refresh orig tarball from Ubuntu archive (openjdk-8_8u502-gaus1.orig.tar.gz, sha1 553d02f135b9c68cf95a2daf0e5db367e4e0569b, size 67975803 bytes; source: archive.ubuntu.com openjdk-8 8u502-gaus1).
• Refresh Ubuntu quilt patches for u502 context:
  • zero-sh.diff (upstream added a RISCV branch to os::dll_load; the ZERO_SH branch and #error list are re-anchored after it)
  • gcc14.diff (upstream adopted the UINT8** freeArray signature in imageioJPEG.c, so that hunk is dropped; parse_manifest.c retained) All 48 quilt patches apply cleanly (0 rejects).
• Ref: ELSCVE-167684, ELSCVE-167634, ELSCVE-167656

• OpenJDK 11.0.32 release, build 9.
  • CVE-2026-41254: 2D component, fix integer overflow in Little CMS CubeSize
  • CVE-2026-46917: JSSE component, improve DTLS handshaking
  • CVE-2026-46968: JSSE component, enhance TLS certificate handling
  • CVE-2026-47010: ImageIO component, enhance JPEG handling
  • CVE-2026-47021: 2D component, enhance XBM image support
  • CVE-2026-47027: Security component, enhance Jar file processing
  • CVE-2026-47057: Scripting component, improve Nashorn index handling
  • CVE-2026-47058: Scripting component, enhance DataView implementation
  • CVE-2026-47059: 2D component, enhance AWT ImagingLib
  • CVE-2026-47063: Security component, enhance Jar handling
  • CVE-2026-60147: Security component, improve certification checking
  • OpenJDK vulnerability advisory: https://openjdk.org/groups/vulnerability/advisories/2026-07-21
• Refresh debian/patches/libpcsclite-dlopen.diff against the upstream macOS Big Sur dynamic linker cache changes in PlatformPCSC.java.

• OpenJDK 11.0.32 release, build 9.
  • CVE-2026-41254: 2D component
  • CVE-2026-46917: JSSE component
  • CVE-2026-46968: JSSE component
  • CVE-2026-47010: ImageIO component
  • CVE-2026-47021: 2D component
  • CVE-2026-47027: Security component
  • CVE-2026-47057: Scripting component, improve Nashorn index handling
  • CVE-2026-47058: Scripting component, enhance DataView implementation
  • CVE-2026-47059: 2D component
  • CVE-2026-47063: Security component, enhance Jar handling
  • CVE-2026-60147: Security component
  • OpenJDK vulnerability advisory: https://openjdk.org/groups/vulnerability/advisories/2026-07-21
• d/p/libpcsclite-dlopen.diff: Refresh patch.

• Upgrade to openjdk-11.0.32+9 (GA). The following CVEs were fixed:
• CVE-2026-46968: enhance TLS certificate handling
• CVE-2026-47010: enhance JPEG handling
• CVE-2026-47021: enhance XBM image support
• CVE-2026-47057: improve Nashorn index handling
• CVE-2026-47058: enhance DataView implementation
• CVE-2026-47063: enhance Jar handling
• Rebase jdk8009550-rh910107-search_for_versioned_libpcsclite.patch on top of upstream JDK-8252412, which reworked the PCSC.framework lookup.

• Upgrade to openjdk-11.0.32+9 (GA). The following CVEs were fixed:
• CVE-2026-46968: enhance TLS certificate handling
• CVE-2026-47010: enhance JPEG handling
• CVE-2026-47021: enhance XBM image support
• CVE-2026-47057: improve Nashorn index handling
• CVE-2026-47058: enhance DataView implementation
• CVE-2026-47063: enhance Jar handling
• Rebase jdk8009550-rh910107-search_for_versioned_libpcsclite.patch on top of upstream JDK-8252412, which reworked the PCSC.framework lookup.

• Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u502-b07. That fixes following CVEs:
• CVE-2026-46968: JSSE, remote high-complexity integrity flaw in TLS certificate handling
• CVE-2026-47010: ImageIO, remote high-complexity low-impact integrity flaw in JPEG handling
• CVE-2026-47021: 2D, remote unauth partial DoS via XBM image support
• CVE-2026-47027: Libraries, remote unauth partial DoS in Jar file processing
• CVE-2026-47057: Scripting, remote unauth DoS via Nashorn index handling
• CVE-2026-47058: Scripting, remote high-complexity high-confidentiality and high-integrity flaw in Dataview implementation
• CVE-2026-47059: 2D, remote high-complexity low-impact partial DoS in AWT ImagingLib
• CVE-2026-47063: Libraries, remote unauth high-integrity flaw in Jar handling
• CVE-2026-60147: Security, remote unauth low-impact flaw in certification checking
• CVE-2026-41254: Little CMS information disclosure / DoS, fixed by the in-tree LCMS bump to 2.19.1 (this build uses --with-lcms=bundled since RHEL 6 has no lcms2)

• Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u502-b07. That fixes following CVEs:
• CVE-2026-46968: JSSE, remote high-complexity integrity flaw in TLS certificate handling
• CVE-2026-47010: ImageIO, remote high-complexity low-impact integrity flaw in JPEG handling
• CVE-2026-47021: 2D, remote unauth partial DoS via XBM image support
• CVE-2026-47027: Libraries, remote unauth partial DoS in Jar file processing
• CVE-2026-47057: Scripting, remote unauth DoS via Nashorn index handling
• CVE-2026-47058: Scripting, remote high-complexity high-confidentiality and high-integrity flaw in Dataview implementation
• CVE-2026-47059: 2D, remote high-complexity low-impact partial DoS in AWT ImagingLib
• CVE-2026-47063: Libraries, remote unauth high-integrity flaw in Jar handling
• CVE-2026-60147: Security, remote unauth low-impact flaw in certification checking
• CVE-2026-41254: Little CMS information disclosure / DoS, fixed by the in-tree LCMS bump to 2.19.1 (this build uses --with-lcms=bundled since RHEL 6 has no lcms2)

• Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u502-b07 (GA). That fixes following CVEs:
• CVE-2026-46968: JSSE, remote high-complexity high-integrity compromise via TLS (enhance TLS certificate handling)
• CVE-2026-47010: ImageIO, remote high-complexity low-impact integrity compromise (enhance JPEG handling)
• CVE-2026-47021: 2D, remote unauthenticated DoS with low availability impact (enhance XBM image support)
• CVE-2026-47057: Scripting, improve Nashorn index handling
• CVE-2026-47058: Scripting, enhance DataView implementation
• CVE-2026-47063: Libraries, enhance Jar handling
• The same upstream release also closes the remaining CVEs of the Oracle July 2026 CPU, tracked under separate ELS tickets:
• CVE-2026-47027: Libraries, enhance Jar file processing
• CVE-2026-47059: 2D, enhance AWT ImagingLib
• CVE-2026-60147: Security, improve certification checking
• CVE-2026-41254: bundled Little CMS updated to 2.19.1

• Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u502-b07 (GA). That fixes following CVEs:
• CVE-2026-46968: JSSE, remote high-complexity high-integrity compromise via TLS (enhance TLS certificate handling)
• CVE-2026-47010: ImageIO, remote high-complexity low-impact integrity compromise (enhance JPEG handling)
• CVE-2026-47021: 2D, remote unauthenticated DoS with low availability impact (enhance XBM image support)
• CVE-2026-47057: Scripting, improve Nashorn index handling
• CVE-2026-47058: Scripting, enhance DataView implementation
• CVE-2026-47063: Libraries, enhance Jar handling
• The same upstream release also closes the remaining CVEs of the Oracle July 2026 CPU, tracked under separate ELS tickets:
• CVE-2026-47027: Libraries, enhance Jar file processing
• CVE-2026-47059: 2D, enhance AWT ImagingLib
• CVE-2026-60147: Security, improve certification checking
• CVE-2026-41254: bundled Little CMS updated to 2.19.1

These are all security issues fixed in the java-11-openjdk-11.0.32.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-1_8_0-openjdk-1.8.0.502-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-11-openj9-11.0.32.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for java-11-openjdk fixes the following issues

Upgrade to upstream tag jdk-11.0.32+9 (July 2026 CPU).

Security issues fixed:

• CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize (bsc#1264994).
• CVE-2026-46917: unauthenticated attacker with network access via TLS can cause a partial denial of service (bsc#1272223).
• CVE-2026-46968: unauthenticated attacker with network access via TLS can gain unauthorized creation, deletion or modification access to critical data(bsc#1272224).
• CVE-2026-47010: unauthenticated attacker with network access via multiple protocols can gain unauthorized update, insert or delete access to some data (bsc#1272225).
• CVE-2026-47021: unauthenticated attacker with network access via multiple protocols can cause a partial denial of service (bsc#1272227).
• CVE-2026-47027: unauthenticated attacker with network access via multiple protocols can cause a partial denial of service (bsc#1272228).
• CVE-2026-47057: unauthenticated attacker with network access via multiple protocols can cause a hang or frequently repeatable crash (bsc#1272233).
• CVE-2026-47058: unauthenticated attacker with network access via multiple protocols can gain unauthorized creation, deletion or modification access to critical data (bsc#1272234).
• CVE-2026-47059: unauthenticated attacker with network access via multiple protocols can cause a partial denial of service (bsc#1272235).
• CVE-2026-47063: unauthenticated attacker with network access via multiple protocols can gain unauthorized creation, deletion or modification access to critical data (bsc#1272236).
• CVE-2026-60147: unauthenticated attacker with network access via multiple protocols can gain unauthorized update, insert, delete and read access to some(bsc#1272237).

Other updates and bugfixes:

• Errors from update-alternatives when installing java-25-openjdk (bsc#1267355).
• Upgrade to upstream tag jdk-11.0.32+9 (July 2026 CPU):
  • JDK-8200566: DistributionPointFetcher fails to fetch CRLs if the DistributionPoints field contains more than one DistributionPoint and the first one fails
  • JDK-8242314: use reproducible random in vmTestbase shared code
  • JDK-8252412: [macos11] system dynamic libraries removed from filesystem
  • JDK-8275405: Linking error for classes with lambda template parameters and virtual functions
  • JDK-8275843: Random crashes while the UI code is executed
  • JDK-8286562: GCC 12 reports some compiler warnings
  • JDK-8287491: compiler/jvmci/errors/TestInvalidDebugInfo.java fails new assert: assert((uint)t < T_CONFLICT + 1) failed: invalid type #
  • JDK-8292177: InitialSecurityProperty JFR event
  • JDK-8293691: converting a defined BasicType value to a string should not crash the VM
  • JDK-8298730: Refactor subsystem_file_line_contents and add docs and tests
  • JDK-8314555: Build with mawk fails on Windows
  • JDK-8323672: Suppress unwanted autoconf added flags in CC and CXX
  • JDK-8324243: Compilation failures in java.desktop module with gcc 14
  • JDK-8325766: Extend CertificateBuilder to create trust and end entity certificates programmatically
  • JDK-8327071: [Testbug] g-tests for cgroup leave files in /tmp on linux
  • JDK-8336498: [macos] [build]: install-file macro may run into permission denied error
  • JDK-8342858: Make target mac-jdk-bundle fails on chmod command
  • JDK-8347740: java/io/File/createTempFile/SpecialTempFile.java failing
  • JDK-8347811: Container detection code for cgroups v2 should use cgroup.controllers
  • JDK-8349988: Change cgroup version detection logic to not depend on /proc/cgroups
  • JDK-8350749: Upgrade JLine to 3.29.0
  • JDK-8351359: OperatingSystemMXBean: values from getCpuLoad and getProcessCpuLoad are stale after 24.8 days (Windows)
  • JDK-8353714: [17u] Backport of 8347740 incomplete
  • JDK-8354878:…

This update for java-11-openjdk fixes the following issues:

Upgrade to upstream tag jdk-11.0.32+9 (July 2026 CPU).

Security issues fixed:

• CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize (bsc#1264994).
• CVE-2026-46917: unauthenticated attacker with network access via TLS can cause a partial denial of service (bsc#1272223).
• CVE-2026-46968: unauthenticated attacker with network access via TLS can gain unauthorized creation, deletion or modification access to critical data(bsc#1272224).
• CVE-2026-47010: unauthenticated attacker with network access via multiple protocols can gain unauthorized update, insert or delete access to some data (bsc#1272225).
• CVE-2026-47021: unauthenticated attacker with network access via multiple protocols can cause a partial denial of service (bsc#1272227).
• CVE-2026-47027: unauthenticated attacker with network access via multiple protocols can cause a partial denial of service (bsc#1272228).
• CVE-2026-47057: unauthenticated attacker with network access via multiple protocols can cause a hang or frequently repeatable crash (bsc#1272233).
• CVE-2026-47058: unauthenticated attacker with network access via multiple protocols can gain unauthorized creation, deletion or modification access to critical data (bsc#1272234).
• CVE-2026-47059: unauthenticated attacker with network access via multiple protocols can cause a partial denial of service (bsc#1272235).
• CVE-2026-47063: unauthenticated attacker with network access via multiple protocols can gain unauthorized creation, deletion or modification access to critical data (bsc#1272236).
• CVE-2026-60147: unauthenticated attacker with network access via multiple protocols can gain unauthorized update, insert, delete and read access to some(bsc#1272237).

Other updates and bugfixes:

• Errors from update-alternatives when installing java-25-openjdk (bsc#1267355).
• Upgrade to upstream tag jdk-11.0.32+9 (July 2026 CPU):
  • JDK-8200566: DistributionPointFetcher fails to fetch CRLs if the DistributionPoints field contains more than one DistributionPoint and the first one fails
  • JDK-8242314: use reproducible random in vmTestbase shared code
  • JDK-8252412: [macos11] system dynamic libraries removed from filesystem
  • JDK-8275405: Linking error for classes with lambda template parameters and virtual functions
  • JDK-8275843: Random crashes while the UI code is executed
  • JDK-8286562: GCC 12 reports some compiler warnings
  • JDK-8287491: compiler/jvmci/errors/TestInvalidDebugInfo.java fails new assert: assert((uint)t < T_CONFLICT + 1) failed: invalid type #
  • JDK-8292177: InitialSecurityProperty JFR event
  • JDK-8293691: converting a defined BasicType value to a string should not crash the VM
  • JDK-8298730: Refactor subsystem_file_line_contents and add docs and tests
  • JDK-8314555: Build with mawk fails on Windows
  • JDK-8323672: Suppress unwanted autoconf added flags in CC and CXX
  • JDK-8324243: Compilation failures in java.desktop module with gcc 14
  • JDK-8325766: Extend CertificateBuilder to create trust and end entity certificates programmatically
  • JDK-8327071: [Testbug] g-tests for cgroup leave files in /tmp on linux
  • JDK-8336498: [macos] [build]: install-file macro may run into permission denied error
  • JDK-8342858: Make target mac-jdk-bundle fails on chmod command
  • JDK-8347740: java/io/File/createTempFile/SpecialTempFile.java failing
  • JDK-8347811: Container detection code for cgroups v2 should use cgroup.controllers
  • JDK-8349988: Change cgroup version detection logic to not depend on /proc/cgroups
  • JDK-8350749: Upgrade JLine to 3.29.0
  • JDK-8351359: OperatingSystemMXBean: values from getCpuLoad and getProcessCpuLoad are stale after 24.8 days (Windows)
  • JDK-8353714: [17u] Backport of 8347740 incomplete
  • JDK-8354878:…

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 8 Fix Pack 70 (bsc#1273223).

• CVE-2026-16243: inconsistent handling of zero length data in arraycmp of the SIMD evaluator (bsc#1274275).
• CVE-2026-16439: using -Xtrace to trace method arguments can lead to buffer underflow (bsc#1272250).
• CVE-2026-16441: method resolution default method precedence failure (bsc#1272248).
• CVE-2026-41254: lcms2: information disclosure or denial of service via integer overflow in CubeSize (bsc#1272459).
• CVE-2026-46968: unauthorized creation, deletion or modification access to critical data (bsc#1272224).
• CVE-2026-47010: unauthorized update, insert or delete access to data (bsc#1272225).
• CVE-2026-47021: partial denial of service via multiple network protocols (bsc#1272227).
• CVE-2026-47027: partial denial of service via multiple network protocols (bsc#1272228).
• CVE-2026-47057: hang or frequently repeatable crash via multiple network protocols (bsc#1272233).
• CVE-2026-47058: unauthorized creation, deletion or modification access to critical data (bsc#1272234).
• CVE-2026-47059: partial denial of service via multiple network protocols (bsc#1272235).
• CVE-2026-47063: unauthorized creation, deletion or modification access to critical data (bsc#1272236).
• CVE-2026-60147: unauthorized update, insert or delete access to data (bsc#1272237).
• CVE-2026-8400: malicious IIOP server can induce loading and instantation of arbitrary classes (bsc#1274276).

This update for java-1_8_0-ibm fixes the following issues:

Update to Java 8.0 Service Refresh 8 Fix Pack 70 (bsc#1273223).

• CVE-2026-16243: inconsistent handling of zero length data in arraycmp of the SIMD evaluator (bsc#1274275).
• CVE-2026-16439: using -Xtrace to trace method arguments can lead to buffer underflow (bsc#1272250).
• CVE-2026-16441: method resolution default method precedence failure (bsc#1272248).
• CVE-2026-41254: lcms2: information disclosure or denial of service via integer overflow in CubeSize (bsc#1272459).
• CVE-2026-46968: unauthorized creation, deletion or modification access to critical data (bsc#1272224).
• CVE-2026-47010: unauthorized update, insert or delete access to data (bsc#1272225).
• CVE-2026-47021: partial denial of service via multiple network protocols (bsc#1272227).
• CVE-2026-47027: partial denial of service via multiple network protocols (bsc#1272228).
• CVE-2026-47057: hang or frequently repeatable crash via multiple network protocols (bsc#1272233).
• CVE-2026-47058: unauthorized creation, deletion or modification access to critical data (bsc#1272234).
• CVE-2026-47059: partial denial of service via multiple network protocols (bsc#1272235).
• CVE-2026-47063: unauthorized creation, deletion or modification access to critical data (bsc#1272236).
• CVE-2026-60147: unauthorized update, insert or delete access to data (bsc#1272237).
• CVE-2026-8400: malicious IIOP server can induce loading and instantation of arbitrary classes (bsc#1274276).

This update for java-1_8_0-openjdk fixes the following issues:

• CVE-2026-41254: lcms2: Information disclosure or denial of service via integer overflow in CubeSize (bsc#1272459).
• CVE-2026-46968: unauthorized creation, deletion or modification access to critical data (bsc#1272224).
• CVE-2026-47010: unauthorized update, insert or delete access (bsc#1272225).
• CVE-2026-47021: partial denial of service via multiple network protocols (bsc#1272227).
• CVE-2026-47027: partial denial of service via multiple network protocols (bsc#1272228).
• CVE-2026-47057: hang or frequently repeatable crash via multiple network protocols (bsc#1272233).
• CVE-2026-47058: unauthorized creation, deletion or modification access to critical data (bsc#1272234).
• CVE-2026-47059: partial denial of service via multiple network protocols (bsc#1272235).
• CVE-2026-47063: unauthorized creation, deletion or modification access to critical data (bsc#1272236).
• CVE-2026-60147: unauthorized update, insert or delete access (bsc#1272237).

Changes for java-1_8_0-openjdk:

• Update to version jdk8u502 (icedtea 3.40.0)
• Import of OpenJDK 8 u502 build 07
  • JDK-6815126: intermittent SimulResumerTest.java failure
  • JDK-8199138: Add RISC-V support to Zero
  • JDK-8209362: sun/security/ssl/SSLSocketImpl/ReuseAddr.java failed due to 'BindException: Address already in use (Bind failed)'
  • JDK-8246330: Add TLS Tests for Legacy ECDSA curves
  • JDK-8249159: Downport test rework for SSLSocketTemplate from JDK-8224650
  • JDK-8261235: C1 compilation fails with assert(res->vreg_number() == index) failed: conversion check
  • JDK-8273135: java/awt/color/ICC_ColorSpace/ /MTTransformReplacedProfile.java crashes in liblcms.dylib with NULLSeek+0x7
  • JDK-8274736: Concurrent read/close of SSLSockets causes SSLSessions to be invalidated unnecessarily
  • JDK-8280158: New test from JDK-8274736 failed with/without patch in JDK11u
  • JDK-8298873: Update IllegalRecordVersion.java for changes to TLS implementation
  • JDK-8301189: validate-source fails after JDK-8298873
  • JDK-8314730: GHA: Drop libfreetype6-dev transitional package in favor of libfreetype-dev
  • JDK-8321489: Update LCMS to 2.16
  • JDK-8336451: [11u] GHA macos-13 and macos-15 builders are unable to resolve local hostname
  • JDK-8348110: Update LCMS to 2.17
  • JDK-8351359: OperatingSystemMXBean: values from getCpuLoad and getProcessCpuLoad are stale after 24.8 days (Windows)
  • JDK-8363966: GHA: Switch cross-compiling sysroots to Debian trixie
  • JDK-8368041: Enhance TLS certificate handling
  • JDK-8369996: Testcase java/net/Socket/B8312065.java fails on Mac, AIX and Solaris
  • JDK-8372351: Add 2 WISeKey roots
  • JDK-8374058: Enhance JPEG handling
  • JDK-8374888: Implement internal test cache to help UserIterCount test performance
  • JDK-8375065: Update LCMS to 2.18
  • JDK-8377158: Enhance XBM image support
  • JDK-8377498: Improve HttpServer handling
  • JDK-8377833: Enhance Jar file processing
  • JDK-8378631: Update Zlib Data Compression Library to Version 1.3.2
  • JDK-8378687: Improve delegation of HttpURLConnection
  • JDK-8379684: Bump update version of OpenJDK: 8u502
  • JDK-8380377: [8u] Problem list CAInterop.java#teliarootcav2
  • JDK-8380672: Improve certification checking
  • JDK-8380689: distrust/Chunghwa.java test fails with a compilation error
  • JDK-8380947: Add pull request template
  • JDK-8381039: Enhance AWT ImagingLib
  • JDK-8381049: Enhance Jar handling
  • JDK-8381185: Improve Nashorn index handling
  • JDK-8381195: Enhance Dataview Implementation
  • JDK-8381519: Enhance Der Value Handling
  • JDK-8381796: Enhance Certificate parsing
  • JDK-8383175: (tz) Update Timezone Data to 2026b
  • JDK-8383354: Update LCMS to 2.19.1
  • JDK-8383473: Follow on from tzdata2026b time change to include temporary hack BC time change
  • JDK-8384158: GHA: Downgrade Windows GHA runners to windows-2022…

This update for java-1_8_0-openjdk fixes the following issues:

Security issues fixed:

• CVE-2026-41254: lcms2: Information disclosure or denial of service via integer overflow in CubeSize (bsc#1272459).
• CVE-2026-46968: unauthorized creation, deletion or modification access to critical data (bsc#1272224).
• CVE-2026-47010: unauthorized update, insert or delete access (bsc#1272225).
• CVE-2026-47021: partial denial of service via multiple network protocols (bsc#1272227).
• CVE-2026-47027: partial denial of service via multiple network protocols (bsc#1272228).
• CVE-2026-47057: hang or frequently repeatable crash via multiple network protocols (bsc#1272233).
• CVE-2026-47058: unauthorized creation, deletion or modification access to critical data (bsc#1272234).
• CVE-2026-47059: partial denial of service via multiple network protocols (bsc#1272235).
• CVE-2026-47063: unauthorized creation, deletion or modification access to critical data (bsc#1272236).
• CVE-2026-60147: unauthorized update, insert or delete access (bsc#1272237).

Non security issue fixed:

• Errors from update-alternatives when installing java-25-openjdk (bsc#1267355).

Changes for java-1_8_0-openjdk:

• Update to version jdk8u502 (icedtea 3.40.0)
• Import of OpenJDK 8 u502 build 07
  • JDK-6815126: intermittent SimulResumerTest.java failure
  • JDK-8199138: Add RISC-V support to Zero
  • JDK-8209362: sun/security/ssl/SSLSocketImpl/ReuseAddr.java failed due to 'BindException: Address already in use (Bind failed)'
  • JDK-8246330: Add TLS Tests for Legacy ECDSA curves
  • JDK-8249159: Downport test rework for SSLSocketTemplate from JDK-8224650
  • JDK-8261235: C1 compilation fails with assert(res->vreg_number() == index) failed: conversion check
  • JDK-8273135: java/awt/color/ICC_ColorSpace/ /MTTransformReplacedProfile.java crashes in liblcms.dylib with NULLSeek+0x7
  • JDK-8274736: Concurrent read/close of SSLSockets causes SSLSessions to be invalidated unnecessarily
  • JDK-8280158: New test from JDK-8274736 failed with/without patch in JDK11u
  • JDK-8298873: Update IllegalRecordVersion.java for changes to TLS implementation
  • JDK-8301189: validate-source fails after JDK-8298873
  • JDK-8314730: GHA: Drop libfreetype6-dev transitional package in favor of libfreetype-dev
  • JDK-8321489: Update LCMS to 2.16
  • JDK-8336451: [11u] GHA macos-13 and macos-15 builders are unable to resolve local hostname
  • JDK-8348110: Update LCMS to 2.17
  • JDK-8351359: OperatingSystemMXBean: values from getCpuLoad and getProcessCpuLoad are stale after 24.8 days (Windows)
  • JDK-8363966: GHA: Switch cross-compiling sysroots to Debian trixie
  • JDK-8368041: Enhance TLS certificate handling
  • JDK-8369996: Testcase java/net/Socket/B8312065.java fails on Mac, AIX and Solaris
  • JDK-8372351: Add 2 WISeKey roots
  • JDK-8374058: Enhance JPEG handling
  • JDK-8374888: Implement internal test cache to help UserIterCount test performance
  • JDK-8375065: Update LCMS to 2.18
  • JDK-8377158: Enhance XBM image support
  • JDK-8377498: Improve HttpServer handling
  • JDK-8377833: Enhance Jar file processing
  • JDK-8378631: Update Zlib Data Compression Library to Version 1.3.2
  • JDK-8378687: Improve delegation of HttpURLConnection
  • JDK-8379684: Bump update version of OpenJDK: 8u502
  • JDK-8380377: [8u] Problem list CAInterop.java#teliarootcav2
  • JDK-8380672: Improve certification checking
  • JDK-8380689: distrust/Chunghwa.java test fails with a compilation error
  • JDK-8380947: Add pull request template
  • JDK-8381039: Enhance AWT ImagingLib
  • JDK-8381049: Enhance Jar handling
  • JDK-8381185: Improve Nashorn index handling
  • JDK-8381195: Enhance Dataview Implementation
  • JDK-8381519: Enhance Der Value Handling
  • JDK-8381796: Enhance Certificate parsing
  • JDK-8383175: (tz) Update Timezone Data to 2026b
  • JDK-8383354: Update LCMS to 2.19.1
  • JDK-8383473: Follow on from tzdata2026b time…

It was discovered that the JSSE component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-46968)

It was discovered that the ImageIO component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-47010)

It was discovered that the 2D component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-47021, CVE-2026-47059)

It was discovered that the Libraries component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-47027)

It was discovered that the Security component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-60147)

It was discovered that the Libraries component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-47063)

It was discovered that the Scripting component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to read or modify sensitive data. (CVE-2026-47057, CVE-2026-47058)

Lian Owen discovered that the 2D (Little CMS) component of OpenJDK 8 did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-41254)

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2026-07-21

It was discovered that the JSSE component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-46968)

It was discovered that the JSSE component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-46917)

It was discovered that the ImageIO component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-47010)

It was discovered that the 2D component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-47021, CVE-2026-47059)

It was discovered that the Libraries component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-47027)

It was discovered that the Security component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-60147)

It was discovered that the Libraries component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-47063)

It was discovered that the Scripting component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to read or modify sensitive data. (CVE-2026-47057, CVE-2026-47058)

Lian Owen discovered that the 2D (Little CMS) component of OpenJDK 11 did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-41254)

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2026-07-21