CVE-2026-46917

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2026-21925)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).(CVE-2026-21932)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or…

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2026-21925)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).(CVE-2026-21932)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or…

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.(CVE-2025-53057)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).(CVE-2025-53066)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2026-21925)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with…

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2026-21925)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).(CVE-2026-21932)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or…

The OpenJDK runtime environment.

Security Fix(es):

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2026-21925)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).(CVE-2026-21932)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or…

The OpenJDK runtime environment.

Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive(CVE-2025-28162)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.(CVE-2025-53057)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).(CVE-2025-53066)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).(CVE-2025-61748)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition:…

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

• JDK: Enhance TLS certificate handling (CVE-2026-46968)

• JDK: Improve DTLS handshaking (CVE-2026-46917)

• JDK: Enhance JPEG handling (CVE-2026-47010)

• JDK: Enhance XBM image support (CVE-2026-47021)

• JDK: Enhance Jar file processing (CVE-2026-47027)

• JDK: Improve certification checking (CVE-2026-60147)

• JDK: Enhance AWT ImagingLib (CVE-2026-47059)

• JDK: Enhance Jar handling (CVE-2026-47063)

• JDK: Update LCMS to 2.19 (CVE-2026-41254)

Enhancement(s):

• For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (Rocky Linux-212474, Rocky Linux-212475, Rocky Linux-212476, Rocky Linux-212477, Rocky Linux-212478, Rocky Linux-212479, Rocky Linux-212480, Rocky Linux-212481)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit.

Security Fix(es):

• JDK: Enhance TLS certificate handling (CVE-2026-46968)

• JDK: Improve DTLS handshaking (CVE-2026-46917)

• JDK: Enhance JPEG handling (CVE-2026-47010)

• JDK: Enhance XBM image support (CVE-2026-47021)

• JDK: Enhance Jar file processing (CVE-2026-47027)

• JDK: Improve certification checking (CVE-2026-60147)

• JDK: Enhance AWT ImagingLib (CVE-2026-47059)

• JDK: Enhance Jar handling (CVE-2026-47063)

• JDK: Update LCMS to 2.19 (CVE-2026-41254)

Enhancement(s):

• For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (Rocky Linux-211046, Rocky Linux-211048)

Bug Fix(es):

• The performance of the Math.pow function regressed between OpenJDK 8 and OpenJDK 11. This was due to an absence of constant folding when applicable (for example, Math.pow(2,1) being replaced by 2). This release reintroduces this optimization. (Rocky Linux-211050, Rocky Linux-211052)
• On Rocky Linux 9 systems, the alternatives list a JDK and architecture pair (for example, "java-11-openjdk.x86_64") followed by the path to the binary in brackets. Rocky Linux 10 systems have a simpler format that just lists the path. Because the OpenJDK 25 packages for Rocky Linux 9 were originally based on those from Rocky Linux 10, they used the simpler format. With this release, the format for OpenJDK 25 packages on Rocky Linux 9 is updated to be closer to other JDKs on that platform. (Rocky Linux-212650)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

• JDK: Enhance TLS certificate handling (CVE-2026-46968)
• JDK: Improve DTLS handshaking (CVE-2026-46917)
• JDK: Enhance JPEG handling (CVE-2026-47010)
• JDK: Enhance XBM image support (CVE-2026-47021)
• JDK: Enhance Jar file processing (CVE-2026-47027)
• JDK: Improve certification checking (CVE-2026-60147)
• JDK: Enhance AWT ImagingLib (CVE-2026-47059)
• JDK: Enhance Jar handling (CVE-2026-47063)
• JDK: Update LCMS to 2.19 (CVE-2026-41254)

Enhancement(s):

• For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212474, AlmaLinux-212475, AlmaLinux-212476, AlmaLinux-212477, AlmaLinux-212478, AlmaLinux-212479, AlmaLinux-212480, AlmaLinux-212481)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.

Security Fix(es):

• JDK: Enhance TLS certificate handling (CVE-2026-46968)
• JDK: Improve DTLS handshaking (CVE-2026-46917)
• JDK: Enhance JPEG handling (CVE-2026-47010)
• JDK: Enhance XBM image support (CVE-2026-47021)
• JDK: Enhance Jar file processing (CVE-2026-47027)
• JDK: Improve certification checking (CVE-2026-60147)
• JDK: Enhance AWT ImagingLib (CVE-2026-47059)
• JDK: Enhance Jar handling (CVE-2026-47063)
• JDK: Update LCMS to 2.19 (CVE-2026-41254)

Enhancement(s):

• For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212337, AlmaLinux-212338, AlmaLinux-212339, AlmaLinux-212340, AlmaLinux-212342, AlmaLinux-212343)

Bug Fix(es):

• In previous releases, the RPM did not correctly own the subdirectories used for documentation in /usr/share/doc and /usr/share/javadoc. This is fixed in this release, so these subdirectories will be removed when the package is uninstalled. (AlmaLinux-212353, AlmaLinux-212359, AlmaLinux-212360, AlmaLinux-212361)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit.

Security Fix(es):

• JDK: Enhance TLS certificate handling (CVE-2026-46968)
• JDK: Improve DTLS handshaking (CVE-2026-46917)
• JDK: Enhance JPEG handling (CVE-2026-47010)
• JDK: Enhance XBM image support (CVE-2026-47021)
• JDK: Enhance Jar file processing (CVE-2026-47027)
• JDK: Improve certification checking (CVE-2026-60147)
• JDK: Enhance AWT ImagingLib (CVE-2026-47059)
• JDK: Enhance Jar handling (CVE-2026-47063)
• JDK: Update LCMS to 2.19 (CVE-2026-41254)

Enhancement(s):

• For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-211046, AlmaLinux-211048)

Bug Fix(es):

• The performance of the Math.pow function regressed between OpenJDK 8 and OpenJDK 11. This was due to an absence of constant folding when applicable (for example, Math.pow(2,1) being replaced by 2). This release reintroduces this optimization. (AlmaLinux-211050, AlmaLinux-211052)
• On AlmaLinux 9 systems, the alternatives list a JDK and architecture pair (for example, "java-11-openjdk.x86_64") followed by the path to the binary in brackets. AlmaLinux 10 systems have a simpler format that just lists the path. Because the OpenJDK 25 packages for AlmaLinux 9 were originally based on those from AlmaLinux 10, they used the simpler format. With this release, the format for OpenJDK 25 packages on AlmaLinux 9 is updated to be closer to other JDKs on that platform. (AlmaLinux-212650)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

• Upgrade to openjdk-11.0.32+9 (GA). The following CVEs were fixed:
• CVE-2026-47063: enhance jar handling
• CVE-2026-46917: improve DTLS handshaking
• CVE-2026-47027: enhance jar file processing
• CVE-2026-47021: enhance XBM image support
• CVE-2026-60147: improve certification checking
• CVE-2026-46968: enhance TLS certificate handling
• CVE-2026-47010: enhance JPEG handling
• CVE-2026-47059: enhance AWT ImagingLib
• CVE-2026-47057: improve Nashorn index handling
• CVE-2026-47058: enhance DataView implementation
• Rebase FIPS patch from the rh-openjdk fips branch (06df8f9bd4) for 11.0.32

• Update to jdk-17.0.20+8 (GA)
• CVE-2026-41254: fix integer overflow in the bundled Little CMS CubeSize function that could lead to information disclosure or denial of service when processing crafted colour profiles (bundled LCMS updated to 2.19.1)
• CVE-2026-46917: improve DTLS handshaking
• CVE-2026-46968: enhance TLS certificate handling
• CVE-2026-47010: enhance JPEG handling
• CVE-2026-47021: enhance XBM image support
• CVE-2026-47027: enhance Jar file processing
• CVE-2026-47059: enhance AWT ImagingLib
• CVE-2026-47063: enhance Jar handling
• CVE-2026-60147: improve certification checking

• Update to jdk-21.0.12+8 (GA)
• CVE-2026-41254: Little CMS integer overflow in CubeSize (bundled LCMS updated to 2.19.1)
• CVE-2026-46917: Improve DTLS handshaking
• CVE-2026-46968: Enhance TLS certificate handling
• CVE-2026-47010: Enhance JPEG handling
• CVE-2026-47021: Enhance XBM image support
• CVE-2026-47027: Enhance Jar file processing
• CVE-2026-47059: Enhance AWT ImagingLib
• CVE-2026-47063: Enhance Jar handling
• CVE-2026-60147: Improve certification checking

• Upgrade to openjdk-11.0.32+9 (GA). The following CVEs were fixed:
• CVE-2026-47063: enhance jar handling
• CVE-2026-46917: improve DTLS handshaking
• CVE-2026-47027: enhance jar file processing
• CVE-2026-47021: enhance XBM image support
• CVE-2026-60147: improve certification checking
• CVE-2026-46968: enhance TLS certificate handling
• CVE-2026-47010: enhance JPEG handling
• CVE-2026-47059: enhance AWT ImagingLib
• CVE-2026-47057: improve Nashorn index handling
• CVE-2026-47058: enhance DataView implementation
• Rebase FIPS patch from the rh-openjdk fips branch (06df8f9bd4) for 11.0.32

• Upgrade to openjdk-11.0.32+9 (GA). The following CVEs were fixed:
• CVE-2026-47063: enhance jar handling
• CVE-2026-46917: improve DTLS handshaking
• CVE-2026-47027: enhance jar file processing
• CVE-2026-47021: enhance XBM image support
• CVE-2026-60147: improve certification checking
• CVE-2026-46968: enhance TLS certificate handling
• CVE-2026-47010: enhance JPEG handling
• CVE-2026-47059: enhance AWT ImagingLib
• CVE-2026-47057: improve Nashorn index handling
• CVE-2026-47058: enhance DataView implementation
• Rebase FIPS patch from the rh-openjdk fips branch (06df8f9bd4) for 11.0.32

• Update to jdk-17.0.20+8 (GA)
• CVE-2026-41254: Little CMS integer overflow in CubeSize (bundled LCMS updated to 2.19.1)
• CVE-2026-46917: Improve DTLS handshaking
• CVE-2026-46968: Enhance TLS certificate handling
• CVE-2026-47010: Enhance JPEG handling
• CVE-2026-47021: Enhance XBM image support
• CVE-2026-47027: Enhance Jar file processing
• CVE-2026-47059: Enhance AWT ImagingLib
• CVE-2026-47063: Enhance Jar handling
• CVE-2026-60147: Improve certification checking

• OpenJDK 8u502 release, build 7 (Oracle July 2026 CPU). Release notes: https://openjdk.org/groups/vulnerability/advisories/2026-07-21
  • Security fixes (8u502):
    • CVE-2026-41254: 2D integer overflow in Little CMS CubeSize
    • CVE-2026-46968: JSSE TLS certificate handling
    • CVE-2026-47010: ImageIO JPEG handling
    • CVE-2026-47021: 2D XBM image support
    • CVE-2026-47027: Security Jar file processing
    • CVE-2026-47057: Scripting Nashorn index handling
    • CVE-2026-47058: Scripting DataView implementation
    • CVE-2026-47059: 2D AWT ImagingLib
    • CVE-2026-47063: Security Jar handling
    • CVE-2026-60147: Security certification checking (CVE-2026-46917 from the same advisory does not affect the 8u train per the OpenJDK 2026-07-21 risk matrix.)
• debian/rules: bump gh_tag to jdk8u502-ga, version_dash_buildnr to 502-b07, gh_tag_aarch32 to jdk8u502-b06-aarch32-20260710.
• Refresh orig tarball from Ubuntu archive (openjdk-8_8u502-gaus1.orig.tar.gz, sha1 553d02f135b9c68cf95a2daf0e5db367e4e0569b, size 67975803 bytes; source: archive.ubuntu.com openjdk-8 8u502-gaus1).
• Refresh Ubuntu quilt patches for u502 context:
  • zero-sh.diff (upstream added a RISCV branch to os::dll_load; the ZERO_SH branch and #error list are re-anchored after it)
  • gcc14.diff (upstream adopted the UINT8** freeArray signature in imageioJPEG.c, so that hunk is dropped; parse_manifest.c retained) All 48 quilt patches apply cleanly (0 rejects).
• Ref: ELSCVE-167684, ELSCVE-167634, ELSCVE-167656

• OpenJDK 11.0.32 release, build 9.
  • CVE-2026-41254: 2D component, fix integer overflow in Little CMS CubeSize
  • CVE-2026-46917: JSSE component, improve DTLS handshaking
  • CVE-2026-46968: JSSE component, enhance TLS certificate handling
  • CVE-2026-47010: ImageIO component, enhance JPEG handling
  • CVE-2026-47021: 2D component, enhance XBM image support
  • CVE-2026-47027: Security component, enhance Jar file processing
  • CVE-2026-47057: Scripting component, improve Nashorn index handling
  • CVE-2026-47058: Scripting component, enhance DataView implementation
  • CVE-2026-47059: 2D component, enhance AWT ImagingLib
  • CVE-2026-47063: Security component, enhance Jar handling
  • CVE-2026-60147: Security component, improve certification checking
  • OpenJDK vulnerability advisory: https://openjdk.org/groups/vulnerability/advisories/2026-07-21
• Refresh debian/patches/libpcsclite-dlopen.diff against the upstream macOS Big Sur dynamic linker cache changes in PlatformPCSC.java.

• OpenJDK 11.0.32 release, build 9.
  • CVE-2026-41254: 2D component
  • CVE-2026-46917: JSSE component
  • CVE-2026-46968: JSSE component
  • CVE-2026-47010: ImageIO component
  • CVE-2026-47021: 2D component
  • CVE-2026-47027: Security component
  • CVE-2026-47057: Scripting component, improve Nashorn index handling
  • CVE-2026-47058: Scripting component, enhance DataView implementation
  • CVE-2026-47059: 2D component
  • CVE-2026-47063: Security component, enhance Jar handling
  • CVE-2026-60147: Security component
  • OpenJDK vulnerability advisory: https://openjdk.org/groups/vulnerability/advisories/2026-07-21
• d/p/libpcsclite-dlopen.diff: Refresh patch.

Enhance TLS certificate handling. (CVE-2026-46968) Improve DTLS handshaking. (CVE-2026-46917) Enhance JPEG handling. (CVE-2026-47010) Enhance XBM image support. (CVE-2026-47021) Enhance Jar file processing. (CVE-2026-47027) Improve certification checking. (CVE-2026-60147) Enhance AWT ImagingLib. (CVE-2026-47059) Enhance Jar handling. (CVE-2026-47063) Improve Resource Resolving. (CVE-2026-60589) Enhance HTTP Connections. (CVE-2026-61308) Enhance TLS server. (CVE-2026-70907)

These are all security issues fixed in the java-11-openjdk-11.0.32.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-17-openjdk-17.0.20.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-26-openjdk-26.0.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-21-openjdk-21.0.12.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the java-25-openjdk-25.0.4.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for java-17-openjdk fixes the following issues

• Upgrade to upstream tag jdk-17.0.20+8 (July 2026 CPU)
• CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize (bsc#1264994).
• CVE-2026-46917: partial denial of service via TLS (bsc#1272223).
• CVE-2026-46968: unauthorized creation, deletion or modification access to critical data (bsc#1272224).
• CVE-2026-47010: unauthorized update, insert or delete access (bsc#1272225).
• CVE-2026-47021: partial denial of service via multiple network protocols (bsc#1272227).
• CVE-2026-47027: partial denial of service via multiple network protocols (bsc#1272228).
• CVE-2026-47059: partial denial of service via multiple network protocols (bsc#1272235).
• CVE-2026-47063: unauthorized creation, deletion or modification access to critical data (bsc#1272236).
• CVE-2026-60147: unauthorized update, insert or delete access (bsc#1272237).

This update for java-25-openjdk fixes the following issues:

• CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize (bsc#1264994).
• CVE-2026-46917: partial denial of service via TLS (bsc#1272223).
• CVE-2026-46968: unauthorized creation, deletion or modification access to critical data (bsc#1272224).
• CVE-2026-47010: unauthorized update, insert or delete access (bsc#1272225).
• CVE-2026-47021: partial denial of service via multiple network protocols (bsc#1272227).
• CVE-2026-47027: partial denial of service via multiple network protocols (bsc#1272228).
• CVE-2026-47059: partial denial of service via multiple network protocols (bsc#1272235).
• CVE-2026-47063: unauthorized creation, deletion or modification access to critical data (bsc#1272236).
• CVE-2026-60147: unauthorized update, insert or delete access (bsc#1272237).

Changes for java-25-openjdk:

• Update to upstream tag jdk-25.0.4+7 (July 2026 CPU):

• JDK-7184899: Test sun/java2d/X11SurfaceData/ /SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail
• JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes fails
• JDK-8064922: [macos] Test javax/swing/JTabbedPane/4624207/ /bug4624207.java fails
• JDK-8068293: [TEST_BUG] Test closed/com/sun/java/swing/plaf/ /motif/InternalFrame/4150591/bug4150591.java fails with GTKLookAndFeel
• JDK-8068310: [TEST_BUG] Test javax/swing/JColorChooser/ /Test4234761.java fails with GTKL&F
• JDK-8144124: [macosx] The tabs can't be aligned when we pressing the key of 'R','B','L','C' or 'T'.
• JDK-8203004: UnixMultiResolutionSplashTest.java fails on Ubuntu16.04
• JDK-8213530: Test java/awt/Modal/ToFront/ /DialogToFrontModeless1Test.java fails on Linux
• JDK-8221451: PIT: sun/java2d/X11SurfaceData/ /SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fails
• JDK-8225787: java/awt/Window/GetScreenLocation/ /GetScreenLocationTest.java fails on Ubuntu
• JDK-8241066: Shenandoah: fix or cleanup SH::do_full_collection
• JDK-8261743: Shenandoah: enable String deduplication with compact heuristics
• JDK-8264851: Shenandoah: Rework control loop mechanics to use timed waits
• JDK-8278102: containers/docker/TestJcmd.java failed with "RuntimeException: Could not find specified process"
• JDK-8279196: Test: jdk/jfr/event/gc/stacktrace/ /TestG1OldAllocationPendingStackTrace.java timed out
• JDK-8297191: [macos] Printing a page range with starting page > 1 results in missing pages
• JDK-8298823: [macos] java/awt/Mouse/EnterExitEvents/ /DragWindowTest.java continues to fail with "No MouseReleased event on label!"
• JDK-8319326: GC: Make TestParallelRefProc use createTestJavaProcessBuilder
• JDK-8319540: GC: Make TestSelectDefaultGC use
• JDK-8321303: Intermittent open/test/jdk/java/awt/ /KeyboardFocusmanager/ConsumeNextMnemonicKeyTypedTest/ /ConsumeNextMnemonicKeyTypedTest.java failure on Linux
• JDK-8321687: Test vmTestbase/nsk/jvmti/scenarios/contention/ /TC03/tc03t002/TestDescription.java failed: JVMTI_ERROR_THREAD_NOT_ALIVE
• JDK-8323792: ThreadSnapshot::initialize can cause assert in Thread::check_for_dangling_thread_pointer (possibility of dangling Thread pointer)
• JDK-8325482: Test that distinct seeds produce distinct traces for compiler stress flags
• JDK-8335355: Shenandoah: Fix race condition in gc/shenandoah/ /mxbeans/TestPauseNotifications.java
• JDK-8339526: C2: store incorrectly removed for clone() transformed to series of loads/stores
• JDK-8340182: Java HttpClient does not follow default retry limit of 3 retries
• JDK-8341735: Rewrite the build/AbsPathsInImage.java test to not load the entire file at once
• JDK-8344345: test/hotspot/gtest/x86/x86-asmtest.py has trailing whitespaces
• JDK-8345631: TestRegionSamplingLogging.java #generational-rotation intermittent fails
• JDK-8347167: Reduce allocation in com.sun.net.httpserver.Headers::normalize
• JDK-8347938: Add Support for the Latest ML-KEM and ML-DSA Private Key Encodings +…

This update for java-21-openjdk fixes the following issues:

• CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize (bsc#1264994).
• CVE-2026-46917: partial denial of service via TLS (bsc#1272223).
• CVE-2026-46968: unauthorized creation, deletion or modification access to critical data (bsc#1272224).
• CVE-2026-47010: unauthorized update, insert or delete access (bsc#1272225).
• CVE-2026-47021: partial denial of service via multiple network protocols (bsc#1272227).
• CVE-2026-47027: partial denial of service via multiple network protocols (bsc#1272228).
• CVE-2026-47059: partial denial of service via multiple network protocols (bsc#1272235).
• CVE-2026-47063: unauthorized creation, deletion or modification access to critical data (bsc#1272236).
• CVE-2026-60147: unauthorized update, insert or delete access (bsc#1272237).

Changes for java-21-openjdk:

• Update to upstream tag jdk-21.0.12+8 (July 2026 CPU):

• JDK-7184899: Test sun/java2d/X11SurfaceData/ /SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail
• JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes fails
• JDK-8064922: [macos] Test javax/swing/JTabbedPane/4624207/ /bug4624207.java fails
• JDK-8068293: [TEST_BUG] Test closed/com/sun/java/swing/plaf/ /motif/InternalFrame/4150591/bug4150591.java fails with GTKLookAndFeel
• JDK-8068310: [TEST_BUG] Test javax/swing/JColorChooser/ /Test4234761.java fails with GTKL&F
• JDK-8068378: [TEST_BUG]The java/awt/Modal/PrintDialogsTest/ /PrintDialogsTest.java instruction need to update
• JDK-8129418: JShell: better highlighting of errors in imports on demand
• JDK-8144124: [macosx] The tabs can't be aligned when we pressing the key of 'R','B','L','C' or 'T'.
• JDK-8183336: Better cleanup for jdk/test/java/lang/module/ /customfs/ModulesInCustomFileSystem.java
• JDK-8203004: UnixMultiResolutionSplashTest.java fails on Ubuntu16.04
• JDK-8212084: G1: Implement UseGCOverheadLimit
• JDK-8213530: Test java/awt/Modal/ToFront/ /DialogToFrontModeless1Test.java fails on Linux
• JDK-8221451: PIT: sun/java2d/X11SurfaceData/ /SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fails
• JDK-8225787: java/awt/Window/GetScreenLocation/ /GetScreenLocationTest.java fails on Ubuntu
• JDK-8255463: java/nio/channels/spi/SelectorProvider/ /inheritedChannel/InheritedChannelTest.java failed with ThreadTimeoutException
• JDK-8274082: Wrong test name in jtreg run tag for java/awt/print/PrinterJob/SwingUIText.java
• JDK-8277444: Data race between JvmtiClassFileReconstituter::copy_bytecodes and class linking
• JDK-8278102: containers/docker/TestJcmd.java failed with "RuntimeException: Could not find specified process"
• JDK-8286258: [Accessibility,macOS,VoiceOver] VoiceOver reads the spinner value wrong and sometime partially
• JDK-8286865: vmTestbase/vm/mlvm/meth/stress/jni/nativeAndMH/ /Test.java fails with Out of space in CodeCache
• JDK-8293484: AArch64: TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails on CPU with SHA512 feature support
• JDK-8297191: [macos] Printing a page range with starting page > 1 results in missing pages
• JDK-8298783: java/lang/ref/FinalizerHistogramTest.java failed with "RuntimeException: MyObject is not found in test output"
• JDK-8298823: [macos] java/awt/Mouse/EnterExitEvents/ /DragWindowTest.java continues to fail with "No MouseReleased event on label!"
• JDK-8299304: Test "java/awt/print/PrinterJob/ /PageDialogTest.java" fails on macOS 13 x64 because the Page Dialog blocks the Toolkit
• JDK-8310645: CancelledResponse.java does not use HTTP/2 when testing the HttpClient
• JDK-8311538: CDS InternSharedString test fails on huge pages host - cannot find shared string
• JDK-8315588: JShell does not accept underscore from JEP 443 even with --enable-preview
• JDK-8318365: Test runtime/cds/appcds/sharedStrings/ /InternSharedString.java fails after JDK-8311538
• JDK-8318662: Refactor some jdk/java/net/httpclient/http2…

This update for java-17-openjdk fixes the following issues

• Upgrade to upstream tag jdk-17.0.20+8 (July 2026 CPU)
• CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize (bsc#1264994).
• CVE-2026-46917: partial denial of service via TLS (bsc#1272223).
• CVE-2026-46968: unauthorized creation, deletion or modification access to critical data (bsc#1272224).
• CVE-2026-47010: unauthorized update, insert or delete access (bsc#1272225).
• CVE-2026-47021: partial denial of service via multiple network protocols (bsc#1272227).
• CVE-2026-47027: partial denial of service via multiple network protocols (bsc#1272228).
• CVE-2026-47059: partial denial of service via multiple network protocols (bsc#1272235).
• CVE-2026-47063: unauthorized creation, deletion or modification access to critical data (bsc#1272236).
• CVE-2026-60147: unauthorized update, insert or delete access (bsc#1272237).

This update for java-17-openjdk fixes the following issues

• Upgrade to upstream tag jdk-17.0.20+8 (July 2026 CPU)
• CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize (bsc#1264994).
• CVE-2026-46917: partial denial of service via TLS (bsc#1272223).
• CVE-2026-46968: unauthorized creation, deletion or modification access to critical data (bsc#1272224).
• CVE-2026-47010: unauthorized update, insert or delete access (bsc#1272225).
• CVE-2026-47021: partial denial of service via multiple network protocols (bsc#1272227).
• CVE-2026-47027: partial denial of service via multiple network protocols (bsc#1272228).
• CVE-2026-47059: partial denial of service via multiple network protocols (bsc#1272235).
• CVE-2026-47063: unauthorized creation, deletion or modification access to critical data (bsc#1272236).
• CVE-2026-60147: unauthorized update, insert or delete access (bsc#1272237).

This update for java-11-openjdk fixes the following issues

Upgrade to upstream tag jdk-11.0.32+9 (July 2026 CPU).

Security issues fixed:

• CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize (bsc#1264994).
• CVE-2026-46917: unauthenticated attacker with network access via TLS can cause a partial denial of service (bsc#1272223).
• CVE-2026-46968: unauthenticated attacker with network access via TLS can gain unauthorized creation, deletion or modification access to critical data(bsc#1272224).
• CVE-2026-47010: unauthenticated attacker with network access via multiple protocols can gain unauthorized update, insert or delete access to some data (bsc#1272225).
• CVE-2026-47021: unauthenticated attacker with network access via multiple protocols can cause a partial denial of service (bsc#1272227).
• CVE-2026-47027: unauthenticated attacker with network access via multiple protocols can cause a partial denial of service (bsc#1272228).
• CVE-2026-47057: unauthenticated attacker with network access via multiple protocols can cause a hang or frequently repeatable crash (bsc#1272233).
• CVE-2026-47058: unauthenticated attacker with network access via multiple protocols can gain unauthorized creation, deletion or modification access to critical data (bsc#1272234).
• CVE-2026-47059: unauthenticated attacker with network access via multiple protocols can cause a partial denial of service (bsc#1272235).
• CVE-2026-47063: unauthenticated attacker with network access via multiple protocols can gain unauthorized creation, deletion or modification access to critical data (bsc#1272236).
• CVE-2026-60147: unauthenticated attacker with network access via multiple protocols can gain unauthorized update, insert, delete and read access to some(bsc#1272237).

Other updates and bugfixes:

• Errors from update-alternatives when installing java-25-openjdk (bsc#1267355).
• Upgrade to upstream tag jdk-11.0.32+9 (July 2026 CPU):
  • JDK-8200566: DistributionPointFetcher fails to fetch CRLs if the DistributionPoints field contains more than one DistributionPoint and the first one fails
  • JDK-8242314: use reproducible random in vmTestbase shared code
  • JDK-8252412: [macos11] system dynamic libraries removed from filesystem
  • JDK-8275405: Linking error for classes with lambda template parameters and virtual functions
  • JDK-8275843: Random crashes while the UI code is executed
  • JDK-8286562: GCC 12 reports some compiler warnings
  • JDK-8287491: compiler/jvmci/errors/TestInvalidDebugInfo.java fails new assert: assert((uint)t < T_CONFLICT + 1) failed: invalid type #
  • JDK-8292177: InitialSecurityProperty JFR event
  • JDK-8293691: converting a defined BasicType value to a string should not crash the VM
  • JDK-8298730: Refactor subsystem_file_line_contents and add docs and tests
  • JDK-8314555: Build with mawk fails on Windows
  • JDK-8323672: Suppress unwanted autoconf added flags in CC and CXX
  • JDK-8324243: Compilation failures in java.desktop module with gcc 14
  • JDK-8325766: Extend CertificateBuilder to create trust and end entity certificates programmatically
  • JDK-8327071: [Testbug] g-tests for cgroup leave files in /tmp on linux
  • JDK-8336498: [macos] [build]: install-file macro may run into permission denied error
  • JDK-8342858: Make target mac-jdk-bundle fails on chmod command
  • JDK-8347740: java/io/File/createTempFile/SpecialTempFile.java failing
  • JDK-8347811: Container detection code for cgroups v2 should use cgroup.controllers
  • JDK-8349988: Change cgroup version detection logic to not depend on /proc/cgroups
  • JDK-8350749: Upgrade JLine to 3.29.0
  • JDK-8351359: OperatingSystemMXBean: values from getCpuLoad and getProcessCpuLoad are stale after 24.8 days (Windows)
  • JDK-8353714: [17u] Backport of 8347740 incomplete
  • JDK-8354878:…

This update for java-25-openjdk fixes the following issues:

Update to upstream tag jdk-25.0.4+7 (July 2026 CPU).

Security issues fixed:

• CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize (bsc#1264994).
• CVE-2026-46917: unauthenticated attacker with network access via TLS can cause a partial denial of service (bsc#1272223).
• CVE-2026-46968: unauthenticated attacker with network access via TLS can gain unauthorized creation, deletion or modification access to critical data(bsc#1272224).
• CVE-2026-47010: unauthenticated attacker with network access via multiple protocols can gain unauthorized update, insert or delete access to some data (bsc#1272225).
• CVE-2026-47021: unauthenticated attacker with network access via multiple protocols can cause a partial denial of service (bsc#1272227).
• CVE-2026-47027: unauthenticated attacker with network access via multiple protocols can cause a partial denial of service (bsc#1272228).
• CVE-2026-47059: unauthenticated attacker with network access via multiple protocols can cause a partial denial of service (bsc#1272235).
• CVE-2026-47063: unauthenticated attacker with network access via multiple protocols can gain unauthorized creation, deletion or modification access to critical data (bsc#1272236).
• CVE-2026-60147: unauthenticated attacker with network access via multiple protocols can gain unauthorized update, insert, delete and read access to some(bsc#1272237).

Other updates and bugfixes:

• Errors from update-alternatives when installing java-25-openjdk (bsc#1267355).
• Make post scripts less noisy (bsc#1267355).
• Use libalternatives instead of update-alternatives for distributions where libalternatives is available.
• Update to upstream tag jdk-25.0.4+7 (July 2026 CPU):
  • JDK-7184899: Test sun/java2d/X11SurfaceData/ /SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail
  • JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes fails
  • JDK-8064922: [macos] Test javax/swing/JTabbedPane/4624207/ /bug4624207.java fails
  • JDK-8068293: [TEST_BUG] Test closed/com/sun/java/swing/plaf/ /motif/InternalFrame/4150591/bug4150591.java fails with GTKLookAndFeel
  • JDK-8068310: [TEST_BUG] Test javax/swing/JColorChooser/ /Test4234761.java fails with GTKL&F
  • JDK-8144124: [macosx] The tabs can't be aligned when we pressing the key of 'R','B','L','C' or 'T'.
  • JDK-8203004: UnixMultiResolutionSplashTest.java fails on Ubuntu16.04
  • JDK-8213530: Test java/awt/Modal/ToFront/ /DialogToFrontModeless1Test.java fails on Linux
  • JDK-8221451: PIT: sun/java2d/X11SurfaceData/ /SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fails
  • JDK-8225787: java/awt/Window/GetScreenLocation/ /GetScreenLocationTest.java fails on Ubuntu
  • JDK-8241066: Shenandoah: fix or cleanup SH::do_full_collection
  • JDK-8261743: Shenandoah: enable String deduplication with compact heuristics
  • JDK-8264851: Shenandoah: Rework control loop mechanics to use timed waits
  • JDK-8278102: containers/docker/TestJcmd.java failed with 'RuntimeException: Could not find specified process'
  • JDK-8279196: Test: jdk/jfr/event/gc/stacktrace/ /TestG1OldAllocationPendingStackTrace.java timed out
  • JDK-8297191: [macos] Printing a page range with starting page > 1 results in missing pages
  • JDK-8298823: [macos] java/awt/Mouse/EnterExitEvents/ /DragWindowTest.java continues to fail with 'No MouseReleased event on label!'
  • JDK-8319326: GC: Make TestParallelRefProc use createTestJavaProcessBuilder
  • JDK-8319540: GC: Make TestSelectDefaultGC use createTestJavaProcessBuilder
  • JDK-8321303: Intermittent open/test/jdk/java/awt/ /KeyboardFocusmanager/ConsumeNextMnemonicKeyTypedTest/ /ConsumeNextMnemonicKeyTypedTest.java failure on Linux
  • JDK-8321687: Test…

This update for java-21-openjdk fixes the following issues:

Update to upstream tag jdk-21.0.12+8 (July 2026 CPU).

Security issues fixed:

• CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in CubeSize (bsc#1264994).
• CVE-2026-46917: unauthenticated attacker with network access via TLS can cause a partial denial of service (bsc#1272223).
• CVE-2026-46968: unauthenticated attacker with network access via TLS can gain unauthorized creation, deletion or modification access to critical data(bsc#1272224).
• CVE-2026-47010: unauthenticated attacker with network access via multiple protocols can gain unauthorized update, insert or delete access to some data (bsc#1272225).
• CVE-2026-47021: unauthenticated attacker with network access via multiple protocols can cause a partial denial of service (bsc#1272227).
• CVE-2026-47027: unauthenticated attacker with network access via multiple protocols can cause a partial denial of service (bsc#1272228).
• CVE-2026-47059: unauthenticated attacker with network access via multiple protocols can cause a partial denial of service (bsc#1272235).
• CVE-2026-47063: unauthenticated attacker with network access via multiple protocols can gain unauthorized creation, deletion or modification access to critical data (bsc#1272236).
• CVE-2026-60147: unauthenticated attacker with network access via multiple protocols can gain unauthorized update, insert, delete and read access to some(bsc#1272237).

Other updates and bugfixes:

• Errors from update-alternatives when installing java-25-openjdk (bsc#1267355).
• Make post scripts less noisy (bsc#1267355).
• Use libalternatives instead of update-alternatives for distributions where libalternatives is available.
• Update to upstream tag jdk-21.0.12+8 (July 2026 CPU):
  • JDK-7184899: Test sun/java2d/X11SurfaceData/ /SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail
  • JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes fails
  • JDK-8064922: [macos] Test javax/swing/JTabbedPane/4624207/ /bug4624207.java fails
  • JDK-8068293: [TEST_BUG] Test closed/com/sun/java/swing/plaf/ /motif/InternalFrame/4150591/bug4150591.java fails with GTKLookAndFeel
  • JDK-8068310: [TEST_BUG] Test javax/swing/JColorChooser/ /Test4234761.java fails with GTKL&F
  • JDK-8068378: [TEST_BUG]The java/awt/Modal/PrintDialogsTest/ /PrintDialogsTest.java instruction need to update
  • JDK-8129418: JShell: better highlighting of errors in imports on demand
  • JDK-8144124: [macosx] The tabs can't be aligned when we pressing the key of 'R','B','L','C' or 'T'.
  • JDK-8183336: Better cleanup for jdk/test/java/lang/module/ /customfs/ModulesInCustomFileSystem.java
  • JDK-8203004: UnixMultiResolutionSplashTest.java fails on Ubuntu16.04
  • JDK-8212084: G1: Implement UseGCOverheadLimit
  • JDK-8213530: Test java/awt/Modal/ToFront/ /DialogToFrontModeless1Test.java fails on Linux
  • JDK-8221451: PIT: sun/java2d/X11SurfaceData/ /SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fails
  • JDK-8225787: java/awt/Window/GetScreenLocation/ /GetScreenLocationTest.java fails on Ubuntu
  • JDK-8255463: java/nio/channels/spi/SelectorProvider/ /inheritedChannel/InheritedChannelTest.java failed with ThreadTimeoutException
  • JDK-8274082: Wrong test name in jtreg run tag for java/awt/print/PrinterJob/SwingUIText.java
  • JDK-8277444: Data race between JvmtiClassFileReconstituter::copy_bytecodes and class linking
  • JDK-8278102: containers/docker/TestJcmd.java failed with 'RuntimeException: Could not find specified process'
  • JDK-8286258: [Accessibility,macOS,VoiceOver] VoiceOver reads the spinner value wrong and sometime partially
  • JDK-8286865: vmTestbase/vm/mlvm/meth/stress/jni/nativeAndMH/ /Test.java fails with Out of space in CodeCache
  • JDK-8293484: AArch64: …