Bug 2556960 (CVE-2026-91333)

Summary:	CVE-2026-91333 openjdk: Improve ciphertext handling (Oracle CPU 2026-10)
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ahughes, fferrari, khosford, mtorre, pjindal, rhel-process-autobot, tfitzsim, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Security component of Oracle Java SE. An unauthenticated remote attacker with network access could exploit this flaw by supplying crafted input to exposed application programming interfaces (APIs) or by executing untrusted code within sandboxed environments. A successful attack allows the adversary to perform unauthorized data modifications, including inserting, updating, or deleting accessible records.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-20 22:56:34 UTC

Vulnerability in Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

Comment 1 Jon Orris 2026-10-27 20:18:48 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9
  Red Hat Enterprise Linux 10

Via RHSA-2026:88347 https://access.redhat.com/errata/RHSA-2026:88347

Comment 2 Jon Orris 2026-10-29 12:25:19 UTC

This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 21.0.12.1

Via RHSA-2026:88350 https://access.redhat.com/errata/RHSA-2026:88350

Comment 3 Jon Orris 2026-10-29 12:26:15 UTC

This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 21.0.13

Via RHSA-2026:88351 https://access.redhat.com/errata/RHSA-2026:88351

Comment 4 Jon Orris 2026-10-29 14:09:36 UTC

This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 25.0.5

Via RHSA-2026:88348 https://access.redhat.com/errata/RHSA-2026:88348

Comment 5 Jon Orris 2026-10-29 14:10:43 UTC

This issue has been addressed in the following products:

  Temurin Build of OpenJDK 25.0.4.1

Via RHSA-2026:90912 https://access.redhat.com/errata/RHSA-2026:90912

Comment 6 Jon Orris 2026-10-29 21:38:45 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support
  Red Hat Enterprise Linux 10

Via RHSA-2026:90504 https://access.redhat.com/errata/RHSA-2026:90504

Comment 7 Jon Orris 2026-10-30 00:16:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8
  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 9.6 Extended Update Support
  Red Hat Enterprise Linux 9

Via RHSA-2026:88349 https://access.redhat.com/errata/RHSA-2026:88349