Java APIs in certain cases may return Distinguished Name strings that are incorrect representations of the encoded form of BMPString, PrintableString, and IA5String.
OpenJDK-8 upstream commit: https://github.com/openjdk/jdk8u/commit/d5ac2ad89a369697a48e7f3e6b889e22afa50a2f OpenJDK-11 upstream commit: https://github.com/openjdk/jdk11u/commit/d3b1c2be9e87aad07cac29d94679130fe5807c17 OpenJDK-17 upstream commit: https://github.com/openjdk/jdk17u/commit/cbba8b9dc39c7e484549fd765c9eb8feb7e122e0 OpenJDK-21 upstream commit: https://github.com/openjdk/jdk21u/commit/643330569baa7c835c2970f0272e9c83883d2a31
This CVE was fixed in Oracle Java SE 8u471, 11.0.29, 17.0.17, 21.0.9, 25.0.1. https://www.oracle.com/java/technologies/javase/8u471-relnotes.html#R180_471 https://www.oracle.com/java/technologies/javase/11-0-29-relnotes.html#R11_0_29 https://www.oracle.com/java/technologies/javase/17-0-17-relnotes.html#R17_0_17 https://www.oracle.com/java/technologies/javase/21-0-9-relnotes.html https://www.oracle.com/java/technologies/javase/25-0-1-relnotes.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Red Hat Enterprise Linux 10 Via RHSA-2025:22672 https://access.redhat.com/errata/RHSA-2025:22672