Bug 2513035 (CVE-2026-60589)

Summary: CVE-2026-60589 OpenJDK: Improve Resource Resolving (2026-08 Security Update)
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ahughes, fferrari, kgaikwad, khosford, mtorre, pjindal, rhel-process-autobot, security-response-team, tfitzsim, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-08-18   

Description OSIDB Bzimport 2026-08-10 07:53:58 UTC
URIDereferencer does not properly use the base URI from
XMLCryptoContext when downloading data.

Comment 1 errata-xmlrpc 2026-08-19 19:26:53 UTC
This issue has been addressed in the following products:

  Red Hat OpenJDK 11 els for RHEL 7
  Red Hat OpenJDK 11 els for RHEL 8
  Red Hat OpenJDK 11 els for RHEL 9

Via RHSA-2026:55778 https://access.redhat.com/errata/RHSA-2026:55778

Comment 2 errata-xmlrpc 2026-08-19 22:43:37 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8
  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 9.6 Extended Update Support
  Red Hat Enterprise Linux 9

Via RHSA-2026:55775 https://access.redhat.com/errata/RHSA-2026:55775

Comment 3 errata-xmlrpc 2026-08-20 10:23:20 UTC
This issue has been addressed in the following products:

  OPENJDK ELS 11.0.32.1

Via RHSA-2026:55780 https://access.redhat.com/errata/RHSA-2026:55780

Comment 4 errata-xmlrpc 2026-08-20 10:24:37 UTC
This issue has been addressed in the following products:

  OPENJDK ELS 11.0.32.1

Via RHSA-2026:55779 https://access.redhat.com/errata/RHSA-2026:55779

Comment 5 errata-xmlrpc 2026-08-27 15:57:41 UTC
This issue has been addressed in the following products:

  Temurin Build of OpenJDK 25.0.4.1

Via RHSA-2026:57118 https://access.redhat.com/errata/RHSA-2026:57118