When AIA is enabled, a client can send its leaf cert without the full chain of intermediate certificates requiring the AIA information to be used. There is no current way to verify the provided URI points to a legitimate source.
This issue has been addressed in the following products: OPENJDK ELS 11.0.30 Via RHSA-2026:0849 https://access.redhat.com/errata/RHSA-2026:0849
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:0931 https://access.redhat.com/errata/RHSA-2026:0931
OpenJDK-8 upstream commit: https://github.com/openjdk/jdk8u/commit/cea3cd4c1d7aa70e998d45ca2e419793a550321e OpenJDK-11 upstream commit: https://github.com/openjdk/jdk11u/commit/5d80a0e0571e163077356904d7810fcc8d9b26f0 OpenJDK-17 upstream commit: https://github.com/openjdk/jdk17u/commit/ae8ed4b8bbb774cc830d2d3647a32e61fb3a9899 OpenJDK-21 upstream commit: https://github.com/openjdk/jdk21u/commit/400d4c96da198f5372178b9f4c5d0e5671ba8781 OpenJDK-25 upstream commit: https://github.com/openjdk/jdk25u/commit/405a5699ebd097464ed3fc9345414b0774a2edc9
This CVE was fixed in Oracle Java SE 8u481, 11.0.30, 17.0.18, 21.0.10, 25.0.2. https://www.oracle.com/java/technologies/javase/8u481-relnotes.html#R180_481 https://www.oracle.com/java/technologies/javase/11-0-30-relnotes.html#R11_0_30 https://www.oracle.com/java/technologies/javase/17-0-18-relnotes.html#R17_0_18 https://www.oracle.com/java/technologies/javase/21-0-10-relnotes.html https://www.oracle.com/java/technologies/javase/25-0-2-relnotes.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:4832 https://access.redhat.com/errata/RHSA-2026:4832