Bug 2557956 (CVE-2026-91394)

Summary:	CVE-2026-91394 openjdk: Enhance HTTP client caching (Oracle CPU 2026-10)
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ahughes, fferrari, khosford, mtorre, pjindal, rhel-process-autobot, tfitzsim, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the OpenJDK Networking component. This vulnerability allows an unauthenticated remote attacker with network access to cause an information disclosure. By supplying crafted input to networking Application Programming Interfaces (APIs), such as through an exposed web service, an attacker could exploit this flaw to gain unauthorized access to critical data.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-21 00:42:45 UTC

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

Comment 1 Jon Orris 2026-10-27 16:29:49 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8
  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:88352 https://access.redhat.com/errata/RHSA-2026:88352

Comment 2 Jon Orris 2026-10-27 19:53:23 UTC

This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 17.0.20.1

Via RHSA-2026:89916 https://access.redhat.com/errata/RHSA-2026:89916

Comment 3 Jon Orris 2026-10-27 19:53:56 UTC

This issue has been addressed in the following products:

  Red Hat Build of OpenJDK 17.0.21

Via RHSA-2026:88353 https://access.redhat.com/errata/RHSA-2026:88353

Comment 4 Jon Orris 2026-10-27 20:17:59 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9
  Red Hat Enterprise Linux 10

Via RHSA-2026:88347 https://access.redhat.com/errata/RHSA-2026:88347