Bug 2513038 (CVE-2026-70907)

Summary:	CVE-2026-70907 OpenJDK: Enhance TLS server (2026-08 Security Update)
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ahughes, fferrari, kgaikwad, khosford, mtorre, pjindal, rhel-process-autobot, security-response-team, tfitzsim, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-08-18

Description OSIDB Bzimport 2026-08-10 07:59:56 UTC

A client can repeatedly replay a ClientHello to a TLS 1.3 server in
order to cause the server to emit an unbounded number of
HelloRetryRequest records.

Comment 1 errata-xmlrpc 2026-08-19 19:26:54 UTC

This issue has been addressed in the following products:

  Red Hat OpenJDK 11 els for RHEL 7
  Red Hat OpenJDK 11 els for RHEL 8
  Red Hat OpenJDK 11 els for RHEL 9

Via RHSA-2026:55778 https://access.redhat.com/errata/RHSA-2026:55778

Comment 2 errata-xmlrpc 2026-08-19 22:43:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8
  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 9.6 Extended Update Support
  Red Hat Enterprise Linux 9

Via RHSA-2026:55775 https://access.redhat.com/errata/RHSA-2026:55775

Comment 3 errata-xmlrpc 2026-08-20 10:23:20 UTC

This issue has been addressed in the following products:

  OPENJDK ELS 11.0.32.1

Via RHSA-2026:55780 https://access.redhat.com/errata/RHSA-2026:55780

Comment 4 errata-xmlrpc 2026-08-20 10:24:41 UTC

This issue has been addressed in the following products:

  OPENJDK ELS 11.0.32.1

Via RHSA-2026:55779 https://access.redhat.com/errata/RHSA-2026:55779

Comment 5 errata-xmlrpc 2026-08-27 15:57:43 UTC

This issue has been addressed in the following products:

  Temurin Build of OpenJDK 25.0.4.1

Via RHSA-2026:57118 https://access.redhat.com/errata/RHSA-2026:57118