{"id":"CVE-2021-41035","aliases":["EUVD-2021-28188","GHSA-cj9m-62w3-rj89","RHSA-2021:5030","RHSA-2022:0310","RHSA-2022:0345","SUSE-SU-2022:0107-1","SUSE-SU-2022:0108-1","SUSE-SU-2022:0166-1","SUSE-SU-2022:14875-1","SUSE-SU-2022:14876-1","openSUSE-SU-2022:0108-1"],"status":"published","title":"In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for...","description":"In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01824,"percentile":0.79103,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-250","CWE-440"],"published":"2021-10-25T15:05:11Z","modified":"2026-10-20T10:53:55Z","affected":[{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.0-1jpp.1.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.0-1jpp.1.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.0-1jpp.1.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.0-1jpp.1.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.0-1jpp.1.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.8.0-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.0-1jpp.1.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.5.0-1jpp.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.5.0-1jpp.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.5.0-1jpp.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.5.0-1jpp.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.5.0-1jpp.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_extras:7","package":"java-1.7.1-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.7.1.5.0-1jpp.1.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.0-1.el8_5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.0-1.el8_5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.0-1.el8_5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.0-1.el8_5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.0-1.el8_5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.0-1.el8_5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.0-1.el8_5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::supplementary","package":"java-1.8.0-ibm-webstart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.0.7.0-1.el8_5"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-30.84.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-30.84.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-30.84.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-30.84.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-30.84.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-30.84.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-30.84.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-30.84.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-30.84.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-30.84.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-30.84.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-30.84.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-30.84.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-30.84.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP3","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-3.53.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-3.53.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-3.53.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-3.53.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-3.53.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-3.53.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-3.53.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-3.53.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-3.53.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-3.53.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-3.53.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-3.53.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-3.53.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-38.65.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"java-1_7_1-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1_sr5.0-26.68.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"java-1_7_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0_sr11.0-65.63.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"seamonkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.53.11.1-lp153.17.5.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-3.53.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"seamonkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.53.11.1-lp153.17.5.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr7.0-3.53.1"}]}],"bundled":12}],"products":[{"vendor":"eclipse","product":"openj9"},{"vendor":"eclipse foundation","product":"eclipse omr"},{"vendor":"the eclipse foundation","product":"eclipse omr"}],"references":[{"url":"https://gitlab.eclipse.org/eclipsefdn/emo-team/emo/-/issues/104","tags":["x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/eclipse-openj9/openj9/pull/13740","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://bugs.eclipse.org/bugs/show_bug.cgi?id=576395","tags":["x_transferred","Vendor Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240621-0006/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41035","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240621-0006"},{"url":"https://github.com/advisories/GHSA-cj9m-62w3-rj89"},{"url":"https://access.redhat.com/errata/RHSA-2021:5030","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2014508","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2014515","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2014518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2015061","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2015308","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2015653","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2027731","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2027791","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5030.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-35556","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-35556","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35556","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-35559","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-35559","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35559","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-35560","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-35560","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35560","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-35564","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-35564","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35564","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-35565","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-35565","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35565","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-35578","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-35578","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35578","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-35586","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-35586","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35586","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41035","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41035","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0310","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0310.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0345","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0345.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220107-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1185055","tags":["report"]},{"url":"https://bugzilla.suse.com/1188564","tags":["report"]},{"url":"https://bugzilla.suse.com/1188565","tags":["report"]},{"url":"https://bugzilla.suse.com/1191902","tags":["report"]},{"url":"https://bugzilla.suse.com/1191904","tags":["report"]},{"url":"https://bugzilla.suse.com/1191905","tags":["report"]},{"url":"https://bugzilla.suse.com/1191909","tags":["report"]},{"url":"https://bugzilla.suse.com/1191910","tags":["report"]},{"url":"https://bugzilla.suse.com/1191911","tags":["report"]},{"url":"https://bugzilla.suse.com/1191913","tags":["report"]},{"url":"https://bugzilla.suse.com/1191914","tags":["report"]},{"url":"https://bugzilla.suse.com/1192052","tags":["report"]},{"url":"https://bugzilla.suse.com/1194198","tags":["report"]},{"url":"https://bugzilla.suse.com/1194232","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41035","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220108-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220166-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188568","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2432","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-202214875-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-202214876-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188566","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-2388","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5GEO4VASAXOQQYTQGGNCUBC3ZY3RFQT4/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-41035","description":"In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.","status":"published","published":"2021-10-25T15:05:11Z","modified":"2024-08-04T02:59:30.989Z","cwes":["CWE-250","CWE-440"],"updated_at":"2026-11-02T14:32:59.430294Z"}],"euvd":[{"id":"EUVD-2021-28188","description":"In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.","status":"published","published":"2021-10-25T15:05:11Z","modified":"2024-08-04T02:59:30Z","updated_at":"2026-11-03T03:24:19.242491Z"}],"ghsa":[{"id":"GHSA-cj9m-62w3-rj89","title":"In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for...","description":"In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.","status":"published","published":"2022-05-24T19:18:42Z","modified":"2024-06-21T21:33:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-250"],"updated_at":"2026-11-02T14:57:30.947324Z"}],"nvd":[{"id":"CVE-2021-41035","description":"In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.","status":"published","published":"2021-10-25T15:15:07.683Z","modified":"2026-06-17T04:07:47.06Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-250","CWE-440"],"updated_at":"2026-11-02T14:07:00.137719Z"}],"osv":[{"id":"CVE-2021-41035","description":"In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods.","status":"published","published":"2021-10-25T15:15:07.683Z","modified":"2026-10-20T10:53:55.835842946Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:21.249056Z"},{"id":"RHSA-2021:5030","title":"Red Hat Security Advisory: java-1.8.0-ibm security update","status":"published","published":"2024-09-13T20:32:53Z","modified":"2026-08-27T10:01:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0310","title":"Red Hat Security Advisory: java-1.7.1-ibm security update","status":"published","published":"2024-09-13T20:33:14Z","modified":"2026-08-27T10:01:46Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0345","title":"Red Hat Security Advisory: java-1.8.0-ibm security update","status":"published","published":"2024-09-13T20:32:36Z","modified":"2026-08-27T10:01:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"openSUSE-SU-2022:0108-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\n- Update to Java 8.0 Service Refresh 7 Fix Pack 0\n- CVE-2021-41035: before version 0.29.0, the openj9 JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods. (bsc#1194198, bsc#1192052)\n- CVE-2021-35586: Excessive memory allocation in BMPImageReader. (bsc#1191914)\n- CVE-2021-35564: Certificates with end dates too far in the future can corrupt keystore. (bsc#1191913)\n- CVE-2021-35559: Excessive memory allocation in RTFReader. (bsc#1191911)\n- CVE-2021-35556: Excessive memory allocation in RTFParser. (bsc#1191910)\n- CVE-2021-35565: Loop in HttpsServer triggered during TLS session close. (bsc#1191909) \n- CVE-2021-35588: Incomplete validation of inner class references in ClassFileParser. (bsc#1191905)\n- CVE-2021-2341: Fixed a flaw inside the FtpClient. (bsc#1188564)\n- CVE-2021-2369: JAR file handling problem containing multiple MANIFEST.MF files. (bsc#1188565)\n- CVE-2021-2163: Incomplete enforcement of JAR signing disabled algorithms. (bsc#1185055)\n- CVE-2021-35560: Fixed a vulnerability in the component Deployment. (bsc#1191902)\n- CVE-2021-35578: Fixed unexpected exception raised during TLS handshake. (bsc#1191904)\n","status":"published","published":"2022-01-18T10:46:46Z","modified":"2026-02-04T03:31:35.352806Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"SUSE-SU-2022:0107-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\n- Update to Java 8.0 Service Refresh 7 Fix Pack 0\n- CVE-2021-41035: before version 0.29.0, the openj9 JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods. (bsc#1194198, bsc#1192052)\n- CVE-2021-35586: Excessive memory allocation in BMPImageReader. (bsc#1191914)\n- CVE-2021-35564: Certificates with end dates too far in the future can corrupt keystore. (bsc#1191913)\n- CVE-2021-35559: Excessive memory allocation in RTFReader. (bsc#1191911)\n- CVE-2021-35556: Excessive memory allocation in RTFParser. (bsc#1191910)\n- CVE-2021-35565: Loop in HttpsServer triggered during TLS session close. (bsc#1191909) \n- CVE-2021-35588: Incomplete validation of inner class references in ClassFileParser. (bsc#1191905)\n- CVE-2021-2341: Fixed a flaw inside the FtpClient. (bsc#1188564)\n- CVE-2021-2369: JAR file handling problem containing multiple MANIFEST.MF files. (bsc#1188565)\n- CVE-2021-2163: Incomplete enforcement of JAR signing disabled algorithms. (bsc#1185055)\n- CVE-2021-35560: Fixed a vulnerability in the component Deployment. (bsc#1191902)\n- CVE-2021-35578: Fixed unexpected exception raised during TLS handshake. (bsc#1191904)\n","status":"published","published":"2022-01-18T10:44:40Z","modified":"2026-02-04T04:19:35.545071Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0108-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues:\n\n- Update to Java 8.0 Service Refresh 7 Fix Pack 0\n- CVE-2021-41035: before version 0.29.0, the openj9 JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods. (bsc#1194198, bsc#1192052)\n- CVE-2021-35586: Excessive memory allocation in BMPImageReader. (bsc#1191914)\n- CVE-2021-35564: Certificates with end dates too far in the future can corrupt keystore. (bsc#1191913)\n- CVE-2021-35559: Excessive memory allocation in RTFReader. (bsc#1191911)\n- CVE-2021-35556: Excessive memory allocation in RTFParser. (bsc#1191910)\n- CVE-2021-35565: Loop in HttpsServer triggered during TLS session close. (bsc#1191909) \n- CVE-2021-35588: Incomplete validation of inner class references in ClassFileParser. (bsc#1191905)\n- CVE-2021-2341: Fixed a flaw inside the FtpClient. (bsc#1188564)\n- CVE-2021-2369: JAR file handling problem containing multiple MANIFEST.MF files. (bsc#1188565)\n- CVE-2021-2163: Incomplete enforcement of JAR signing disabled algorithms. (bsc#1185055)\n- CVE-2021-35560: Fixed a vulnerability in the component Deployment. (bsc#1191902)\n- CVE-2021-35578: Fixed unexpected exception raised during TLS handshake. (bsc#1191904)\n","status":"published","published":"2022-01-18T10:47:16Z","modified":"2026-02-04T02:37:19.21265Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0166-1","title":"Security update for java-1_7_1-ibm","description":"This update for java-1_7_1-ibm fixes the following issues:\n\n- Update to Java 7.1 Service Refresh 5 Fix Pack 0\n- CVE-2021-41035: before version 0.29.0, the openj9 JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods. (bsc#1194198, bsc#1192052)\n- CVE-2021-35586: Excessive memory allocation in BMPImageReader. (bsc#1191914)\n- CVE-2021-35564: Certificates with end dates too far in the future can corrupt keystore. (bsc#1191913)\n- CVE-2021-35559: Excessive memory allocation in RTFReader. (bsc#1191911)\n- CVE-2021-35556: Excessive memory allocation in RTFParser. (bsc#1191910)\n- CVE-2021-35565: Loop in HttpsServer triggered during TLS session close. (bsc#1191909) \n- CVE-2021-35588: Incomplete validation of inner class references in ClassFileParser. (bsc#1191905)\n- CVE-2021-2341: Fixed a flaw inside the FtpClient. (bsc#1188564)\n- CVE-2021-2369: JAR file handling problem containing multiple MANIFEST.MF files. (bsc#1188565)\n- CVE-2021-2432: Fixed a vulnerability in the omponent JNDI. (bsc#1188568)\n- CVE-2021-2163: Incomplete enforcement of JAR signing disabled algorithms. (bsc#1185055)\n","status":"published","published":"2022-01-24T15:31:46Z","modified":"2026-02-04T02:31:56.802006Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:14875-1","title":"Security update for java-1_7_1-ibm","description":"This update for java-1_7_1-ibm fixes the following issues:\n\n- Update to Java 7.1 Service Refresh 5 Fix Pack 0\n- CVE-2021-41035: before version 0.29.0, the openj9 JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods. (bsc#1194198, bsc#1192052)\n- CVE-2021-35586: Excessive memory allocation in BMPImageReader. (bsc#1191914)\n- CVE-2021-35564: Certificates with end dates too far in the future can corrupt keystore. (bsc#1191913)\n- CVE-2021-35559: Excessive memory allocation in RTFReader. (bsc#1191911)\n- CVE-2021-35556: Excessive memory allocation in RTFParser. (bsc#1191910)\n- CVE-2021-35565: Loop in HttpsServer triggered during TLS session close. (bsc#1191909) \n- CVE-2021-35588: Incomplete validation of inner class references in ClassFileParser. (bsc#1191905)\n- CVE-2021-2341: Fixed a flaw inside the FtpClient. (bsc#1188564)\n- CVE-2021-2369: JAR file handling problem containing multiple MANIFEST.MF files. (bsc#1188565)\n- CVE-2021-2432: Fixed a vulnerability in the omponent JNDI. (bsc#1188568)\n- CVE-2021-2163: Incomplete enforcement of JAR signing disabled algorithms. (bsc#1185055)\n","status":"published","published":"2022-01-18T10:47:47Z","modified":"2026-02-04T03:37:21.593554Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:14876-1","title":"Security update for java-1_7_1-ibm","description":"This update for java-1_7_1-ibm fixes the following issues:\n\n- Update to Java 7.1 Service Refresh 5 Fix Pack 0\n- CVE-2021-41035: before version 0.29.0, the openj9 JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods. (bsc#1194198, bsc#1192052)\n- CVE-2021-35586: Excessive memory allocation in BMPImageReader. (bsc#1191914)\n- CVE-2021-35564: Certificates with end dates too far in the future can corrupt keystore. (bsc#1191913)\n- CVE-2021-35559: Excessive memory allocation in RTFReader. (bsc#1191911)\n- CVE-2021-35556: Excessive memory allocation in RTFParser. (bsc#1191910)\n- CVE-2021-35565: Loop in HttpsServer triggered during TLS session close. (bsc#1191909) \n- CVE-2021-35588: Incomplete validation of inner class references in ClassFileParser. (bsc#1191905)\n- CVE-2021-2341: Fixed a flaw inside the FtpClient. (bsc#1188564)\n- CVE-2021-2369: JAR file handling problem containing multiple MANIFEST.MF files. (bsc#1188565)\n- CVE-2021-2432: Fixed a vulnerability in the omponent JNDI. (bsc#1188568)\n- CVE-2021-2163: Incomplete enforcement of JAR signing disabled algorithms. (bsc#1185055)\n- CVE-2021-2388: Fixed a flaw inside the Hotspot component performed range check elimination. (bsc#1188566)\n","status":"published","published":"2022-01-18T13:28:58Z","modified":"2026-02-04T02:17:09.192265Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}