{"id":"CVE-2026-1188","aliases":["EUVD-2026-4991","GHSA-x24c-w26v-w8jg","SUSE-SU-2026:2036-1","SUSE-SU-2026:2110-1","SUSE-SU-2026:2453-1","openSUSE-SU-2026:10788-1","openSUSE-SU-2026:10789-1","openSUSE-SU-2026:10790-1","openSUSE-SU-2026:10791-1","openSUSE-SU-2026:10792-1","openSUSE-SU-2026:20943-1","openSUSE-SU-2026:20947-1"],"status":"published","title":"In the Eclipse OMR port library component since release 0.2.0, an API function to return the...","description":"In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00486,"percentile":0.42362,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120","CWE-131"],"published":"2026-01-29T08:36:02Z","modified":"2026-10-28T02:30:47Z","fixes":[{"ecosystem":"openSUSE:Tumbleweed","package":"java-11-openj9","fixed_in":["11.0.31.0-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"java-17-openj9","fixed_in":["17.0.19.0-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"java-1_8_0-openj9","fixed_in":["1.8.0.492-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"java-21-openj9","fixed_in":["21.0.11.0-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"java-25-openj9","fixed_in":["25.0.3.0-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.65-30.150.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"java-1_8_0-ibm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0_sr8.65-30.150.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"java-11-openj9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.31.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"java-17-openj9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.19.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"java-1_8_0-openj9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0.492-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"java-21-openj9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.0.11.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"java-25-openj9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.3.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"java-17-openj9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.19.0-bp160.1.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"java-21-openj9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.0.11.0-bp160.1.1"}]}],"bundled":28}],"products":[{"vendor":"eclipse","product":"omr"},{"vendor":"eclipse foundation","product":"eclipse omr"}],"references":[{"url":"https://github.com/eclipse-omr/omr/pull/8082","tags":["Issue Tracking","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1188","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x24c-w26v-w8jg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1188.json","tags":["advisory"]},{"url":"https://github.com/eclipse-omr/omr","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262036-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259118","tags":["report"]},{"url":"https://bugzilla.suse.com/1262490","tags":["report"]},{"url":"https://bugzilla.suse.com/1262494","tags":["report"]},{"url":"https://bugzilla.suse.com/1262495","tags":["report"]},{"url":"https://bugzilla.suse.com/1262496","tags":["report"]},{"url":"https://bugzilla.suse.com/1262497","tags":["report"]},{"url":"https://bugzilla.suse.com/1262500","tags":["report"]},{"url":"https://bugzilla.suse.com/1265261","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34268","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262110-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1264735","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262453-1/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1231702","tags":["report"]},{"url":"https://bugzilla.suse.com/1231711","tags":["report"]},{"url":"https://bugzilla.suse.com/1231716","tags":["report"]},{"url":"https://bugzilla.suse.com/1231719","tags":["report"]},{"url":"https://bugzilla.suse.com/1235844","tags":["report"]},{"url":"https://bugzilla.suse.com/1236278","tags":["report"]},{"url":"https://bugzilla.suse.com/1236804","tags":["report"]},{"url":"https://bugzilla.suse.com/1241274","tags":["report"]},{"url":"https://bugzilla.suse.com/1241275","tags":["report"]},{"url":"https://bugzilla.suse.com/1241276","tags":["report"]},{"url":"https://bugzilla.suse.com/1246575","tags":["report"]},{"url":"https://bugzilla.suse.com/1246584","tags":["report"]},{"url":"https://bugzilla.suse.com/1246595","tags":["report"]},{"url":"https://bugzilla.suse.com/1246598","tags":["report"]},{"url":"https://bugzilla.suse.com/1246806","tags":["report"]},{"url":"https://bugzilla.suse.com/1252414","tags":["report"]},{"url":"https://bugzilla.suse.com/1252417","tags":["report"]},{"url":"https://bugzilla.suse.com/1257034","tags":["report"]},{"url":"https://bugzilla.suse.com/1257036","tags":["report"]},{"url":"https://bugzilla.suse.com/1257037","tags":["report"]},{"url":"https://bugzilla.suse.com/1257038","tags":["report"]},{"url":"https://bugzilla.suse.com/1262501","tags":["report"]},{"url":"https://bugzilla.suse.com/1267355","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-21587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-50059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-50106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34282","tags":["web"]},{"url":"https://bugzilla.suse.com/1252418","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61748","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-1188","description":"In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.","status":"published","published":"2026-01-29T08:36:02.88Z","modified":"2026-01-29T16:42:05.567Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","level":"medium","assessor":"cna"}],"cwes":["CWE-131"],"updated_at":"2026-11-02T14:20:00.879257Z"}],"euvd":[{"id":"EUVD-2026-4991","description":"In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.","status":"published","published":"2026-01-29T08:36:02Z","modified":"2026-01-29T16:42:05Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","level":"medium"}],"updated_at":"2026-11-02T19:48:45.944715Z"}],"ghsa":[{"id":"GHSA-x24c-w26v-w8jg","title":"In the Eclipse OMR port library component since release 0.2.0, an API function to return the...","description":"In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.","status":"published","published":"2026-01-29T09:31:49Z","modified":"2026-02-09T15:31:32Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-120","CWE-131"],"updated_at":"2026-11-02T15:06:06.621924Z"}],"nvd":[{"id":"CVE-2026-1188","description":"In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.","status":"published","published":"2026-01-29T09:16:03.56Z","modified":"2026-06-17T10:15:17.76Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-131","CWE-120"],"updated_at":"2026-11-02T14:12:04.769088Z"}],"osv":[{"id":"CVE-2026-1188","description":"In the Eclipse OMR port library component since release 0.2.0, an API function to return the textual names of all supported processor features was not accounting for the separator inserted between processor features. If the output buffer supplied to this function was incorrectly sized, failing to account for the separator when determining when a write to the buffer was safe could lead to a buffer overflow. This issue is fixed in Eclipse OMR version 0.8.0.","status":"published","published":"2026-01-29T08:36:02.88Z","modified":"2026-10-28T02:30:47.458537426Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","level":"medium"}],"cwes":["CWE-131"],"updated_at":"2026-11-02T15:44:57.008854Z"},{"id":"openSUSE-SU-2026:10788-1","title":"java-11-openj9-11.0.31.0-2.1 on GA media","description":"These are all security issues fixed in the java-11-openj9-11.0.31.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-16T00:00:00Z","modified":"2026-05-17T14:18:07.463801Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:10789-1","title":"java-17-openj9-17.0.19.0-2.1 on GA media","description":"These are all security issues fixed in the java-17-openj9-17.0.19.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-16T00:00:00Z","modified":"2026-05-17T14:18:08.2343Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:10790-1","title":"java-1_8_0-openj9-1.8.0.492-2.1 on GA media","description":"These are all security issues fixed in the java-1_8_0-openj9-1.8.0.492-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-16T00:00:00Z","modified":"2026-05-17T14:18:07.871828Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:10791-1","title":"java-21-openj9-21.0.11.0-2.1 on GA media","description":"These are all security issues fixed in the java-21-openj9-21.0.11.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-16T00:00:00Z","modified":"2026-05-17T14:18:08.21341Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:10792-1","title":"java-25-openj9-25.0.3.0-2.1 on GA media","description":"These are all security issues fixed in the java-25-openj9-25.0.3.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-16T00:00:00Z","modified":"2026-05-17T14:18:07.835694Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20943-1","title":"Security update for java-17-openj9","description":"This update for java-17-openj9 fixes the following issues:\n\nChanges in java-17-openj9:\n\n- Make post scripts less noisy (bsc#1267355)\n\n- Use libalternatives instead of update-alternatives for\n  distributions where libalternatives is available\n\n- Update to OpenJDK 17.0.19 with OpenJ9 0.59.0 virtual machine\n- Including Oracle April 2026 CPU changes\n  * CVE-2026-22007 (bsc#1262490), CVE-2026-22013 (bsc#1262494),\n    CVE-2026-22016 (bsc#1262495), CVE-2026-22018 (bsc#1262496),\n    CVE-2026-22021 (bsc#1262497), CVE-2026-23865 (bsc#1259118),\n    CVE-2026-34268 (bsc#1262500), CVE-2026-34282 (bsc#1262501)\n- OpenJ9 specific security fix\n  * CVE-2026-1188 (bsc#1265261)\n  * OpenJ9 changes, see\n    https://www.eclipse.org/openj9/docs/version0.59/\n\n- Update to OpenJDK 17.0.18 with OpenJ9 0.57.0 virtual machine\n- Including Oracle January 2026 CPU changes\n  * CVE-2026-21925 (bsc#1257034), CVE-2026-21932 (bsc#1257036),\n    CVE-2026-21933 (bsc#1257037), CVE-2026-21945 (bsc#1257038)\n  * OpenJ9 changes, see\n    https://www.eclipse.org/openj9/docs/version0.57/\n\n- Do not depend on update-desktop-files (jsc#PED-14507)\n\n- Update to OpenJDK 17.0.17 with OpenJ9 0.56.0 virtual machine\n- Including Oracle October 2025 CPU changes\n  * CVE-2025-53057 (bsc#1252414), CVE-2025-53066 (bsc#1252417)\n  * OpenJ9 changes, see\n    https://www.eclipse.org/openj9/docs/version0.56/\n\n- Update to OpenJDK 17.0.16 with OpenJ9 0.53.0 virtual machine\n- Including Oracle July 2025 CPU changes\n  * CVE-2025-30749 (bsc#1246595), CVE-2025-30754 (bsc#1246598),\n    CVE-2025-50059 (bsc#1246575), CVE-2025-50106 (bsc#1246584)\n  * OpenJ9 changes, see\n    https://www.eclipse.org/openj9/docs/version0.53/\n- Enable bootcycle build\n\n- Do not embed rebuild counter (bsc#1246806)\n\n- Add -std=gnu99 to CFLAGS to fix gcc15 compile time error. Since\n  the C++ part is on -std=gnu++98, this is the closest.\n- Added patch:\n  * fix-build-with-gcc15.patch\n    + fix a typo in omr that is fatal with gcc15\n\n- Update to OpenJDK 17.0.15 with OpenJ9 0.51.0 virtual machine\n- Including Oracle April 2025 CPU changes\n  * CVE-2025-21587 (bsc#1241274), CVE-2025-30691 (bsc#1241275),\n    CVE-2025-30698 (bsc#1241276)\n  * OpenJ9 changes, see\n    https://www.eclipse.org/openj9/docs/version0.51/\n\n- fix wrong execstack flag in libj9jit (bsc#1235844)\n\n- Update to OpenJDK 17.0.14 with OpenJ9 0.49.0 virtual machine\n- Including Oracle October 2024 and January 2025 CPU changes\n  * CVE-2024-21208 (bsc#1231702), CVE-2024-21210 (bsc#1231711),\n    CVE-2024-21217 (bsc#1231716), CVE-2024-21235 (bsc#1231719),\n    CVE-2025-21502 (bsc#1236278)\n  * OpenJ9 changes, see\n    https://www.eclipse.org/openj9/docs/version0.49/\n","status":"published","published":"2026-06-11T07:34:54Z","modified":"2026-06-13T18:24:19.600416001Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:20947-1","title":"Security update for java-21-openj9","description":"This update for java-21-openj9 fixes the following issues:\n\nChanges in java-21-openj9:\n\n- Make post scripts less noisy (bsc#1267355)\n\n- Use libalternatives instead of update-alternatives for\n  distributions where libalternatives is available\n\n- Update to OpenJDK 21.0.11 with OpenJ9 0.59.0 virtual machine\n- Including Oracle April 2026 CPU changes\n  * CVE-2026-22007 (bsc#1262490), CVE-2026-22013 (bsc#1262494),\n    CVE-2026-22016 (bsc#1262495), CVE-2026-22018 (bsc#1262496),\n    CVE-2026-22021 (bsc#1262497), CVE-2026-23865 (bsc#1259118),\n    CVE-2026-34268 (bsc#1262500), CVE-2026-34282 (bsc#1262501)\n- OpenJ9 specific security fix\n  * CVE-2026-1188 (bsc#1265261)\n  * OpenJ9 changes, see\n    https://www.eclipse.org/openj9/docs/version0.59/\n\n- Update to OpenJDK 21.0.10 with OpenJ9 0.57.0 virtual machine\n- Including Oracle January 2026 CPU changes\n  * CVE-2026-21925 (bsc#1257034), CVE-2026-21932 (bsc#1257036),\n    CVE-2026-21933 (bsc#1257037), CVE-2026-21945 (bsc#1257038)\n  * OpenJ9 changes, see\n    https://www.eclipse.org/openj9/docs/version0.57/\n\n- Do not depend on update-desktop-files (jsc#PED-14507)\n\n- Update to OpenJDK 21.0.9 with OpenJ9 0.56.0 virtual machine\n- Including Oracle October 2025 CPU changes\n  * CVE-2025-53057 (bsc#1252414), CVE-2025-53066 (bsc#1252417),\n    CVE-2025-61748 (bsc#1252418)\n  * OpenJ9 changes, see\n    https://www.eclipse.org/openj9/docs/version0.56/\n\n- Update to OpenJDK 21.0.8 with OpenJ9 0.53.0 virtual machine\n- Including Oracle July 2025 CPU changes\n  * CVE-2025-30749 (bsc#1246595), CVE-2025-30754 (bsc#1246598),\n    CVE-2025-50059 (bsc#1246575), CVE-2025-50106 (bsc#1246584)\n  * OpenJ9 changes, see\n    https://www.eclipse.org/openj9/docs/version0.53/\n- Enable bootcycle build\n\n- Do not embed rebuild counter (bsc#1246806)\n\n- Add -std=gnu99 to CFLAGS to fix gcc15 compile time error. Since\n  the C++ part is on -std=gnu++98, this is the closest.\n\n- Update to OpenJDK 21.0.7 with OpenJ9 0.51.0 virtual machine\n- Including Oracle April 2025 CPU changes\n  * CVE-2025-21587 (bsc#1241274), CVE-2025-30691 (bsc#1241275),\n    CVE-2025-30698 (bsc#1241276)\n  * OpenJ9 changes, see\n    https://www.eclipse.org/openj9/docs/version0.51/\n\n- fix wrong execstack flag in libj9jit (bsc#1235844)\n\n- Update to OpenJDK 21.0.6 with OpenJ9 0.49.0 virtual machine\n- Including Oracle October 2024 and January 2025 CPU changes\n  * CVE-2024-21208 (bsc#1231702), CVE-2024-21210 (bsc#1231711),\n    CVE-2024-21217 (bsc#1231716), CVE-2024-21235 (bsc#1231719),\n    CVE-2025-21502 (bsc#1236278)\n  * OpenJ9 changes, see\n    https://www.eclipse.org/openj9/docs/version0.49/\n","status":"published","published":"2026-06-12T00:33:03Z","modified":"2026-06-13T08:00:06.821696084Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:2036-1","title":"Security update for java-1_8_0-openj9","description":"This update for java-1_8_0-openj9 fixes the following issues\n\n- CVE-2026-1188: eclipse: ensure room for separator in omrsysinfo_get_processor_feature_string (bsc#1265261).\n- CVE-2026-22007: APIs in the specified component can lead to an unauthorized read access (bsc#1262490).\n- CVE-2026-22013: unauthenticated attacker with network access can access to critical data (bsc#1262494).\n- CVE-2026-22016: APIs in the specified Component can cause unauthorized access to critical data (bsc#1262495).\n- CVE-2026-22018: unauthenticated attacker with network access can cause a partial denial of service (bsc#1262496).\n- CVE-2026-22021: APIs in the specified Component can cause a partial denial of service (bsc#1262497).\n- CVE-2026-23865: Integer overflow in the tt_var_load_item_variation_store function (bsc#1259118).\n- CVE-2026-34268: unauthenticated attacker with logon can gain unauthorized read access (bsc#1262500).\n\nChanges for java-1_8_0-openj9:\n\n- Update to OpenJDK 8u492 build 09 with OpenJ9 0.59.0 virtual\n machine\n","status":"published","published":"2026-05-21T11:56:21Z","modified":"2026-05-22T09:00:05.164447844Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:2110-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues\n\n- CVE-2026-22007: APIs in the specified component can lead to an unauthorized read access (bsc#1262490).\n- CVE-2026-22013: unauthenticated attacker with network access can access to critical data (bsc#1262494).\n- CVE-2026-22016: APIs in the specified Component can cause unauthorized access to critical data (bsc#1262495).\n- CVE-2026-22018: unauthenticated attacker with network access can cause a partial denial of service (bsc#1262496).\n- CVE-2026-22021: APIs in the specified Component can cause a partial denial of service (bsc#1262497).\n- CVE-2026-34268: unauthenticated attacker with logon can gain unauthorized read access (bsc#1262500).\n- CVE-2026-1188: eclipse: ensure room for separator in omrsysinfo_get_processor_feature_string (bsc#1265261)\n\nChanges for java-1_8_0-ibm:\n\n- Update to Java 8.0 Service Refresh 8 Fix Pack 65 (bsc#1264735)\n","status":"published","published":"2026-05-29T09:30:01Z","modified":"2026-05-30T23:15:04.990094703Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:2453-1","title":"Security update for java-1_8_0-ibm","description":"This update for java-1_8_0-ibm fixes the following issues\n\n- CVE-2026-22007: APIs in the specified component can lead to an unauthorized read access (bsc#1262490).\n- CVE-2026-22013: unauthenticated attacker with network access can access to critical data (bsc#1262494).\n- CVE-2026-22016: APIs in the specified Component can cause unauthorized access to critical data (bsc#1262495).\n- CVE-2026-22018: unauthenticated attacker with network access can cause a partial denial of service (bsc#1262496).\n- CVE-2026-22021: APIs in the specified Component can cause a partial denial of service (bsc#1262497).\n- CVE-2026-34268: unauthenticated attacker with logon can gain unauthorized read access (bsc#1262500).\n- CVE-2026-1188: eclipse: ensure room for separator in omrsysinfo_get_processor_feature_string (bsc#1265261)\n\nChanges for java-1_8_0-ibm:\n\n- Update to Java 8.0 Service Refresh 8 Fix Pack 65 (bsc#1264735)\n","status":"published","published":"2026-06-18T13:49:51Z","modified":"2026-06-19T08:15:07.016474915Z","updated_at":"2026-11-02T15:54:04.519245Z"}]}}