Bug 2557056 (CVE-2026-87291)

Summary:	CVE-2026-87291 openjdk: Enhance HTTP Server (Oracle CPU 2026-10)
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ahughes, fferrari, khosford, mtorre, pjindal, rhel-process-autobot, tfitzsim, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Java SE Networking component. An unauthenticated remote attacker can exploit this vulnerability by submitting specially crafted data to network application programming interfaces (APIs), such as through a web service. Successful exploitation allows unauthorized read access to a subset of accessible data, leading to information disclosure.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-20 23:06:51 UTC

Vulnerability in Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and  27. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Comment 1 Jon Orris 2026-10-27 20:18:34 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9
  Red Hat Enterprise Linux 10

Via RHSA-2026:88347 https://access.redhat.com/errata/RHSA-2026:88347

Comment 2 Jon Orris 2026-10-29 12:25:25 UTC

This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 21.0.12.1

Via RHSA-2026:88350 https://access.redhat.com/errata/RHSA-2026:88350

Comment 3 Jon Orris 2026-10-29 12:26:20 UTC

This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 21.0.13

Via RHSA-2026:88351 https://access.redhat.com/errata/RHSA-2026:88351

Comment 4 Jon Orris 2026-10-29 14:09:57 UTC

This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 25.0.5

Via RHSA-2026:88348 https://access.redhat.com/errata/RHSA-2026:88348

Comment 5 Jon Orris 2026-10-29 14:10:49 UTC

This issue has been addressed in the following products:

  Temurin Build of OpenJDK 25.0.4.1

Via RHSA-2026:90912 https://access.redhat.com/errata/RHSA-2026:90912

Comment 6 Jon Orris 2026-10-29 21:38:52 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support
  Red Hat Enterprise Linux 10

Via RHSA-2026:90504 https://access.redhat.com/errata/RHSA-2026:90504

Comment 7 Jon Orris 2026-10-30 00:16:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8
  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 9.6 Extended Update Support
  Red Hat Enterprise Linux 9

Via RHSA-2026:88349 https://access.redhat.com/errata/RHSA-2026:88349