Fedora Account System
Red Hat Associate
Red Hat Customer
Missing validation of ZIP64 content in a ZIP file can lead to out-of-bounds reads.
This CVE was fixed in Oracle Java SE 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3. https://www.oracle.com/java/technologies/javase/8u491-relnotes.html#R180_491 https://www.oracle.com/java/technologies/javase/11-0-31-relnotes.html#R11_0_31 https://www.oracle.com/java/technologies/javase/17-0-19-relnotes.html#R17_0_19 https://www.oracle.com/java/technologies/javase/21-0-11-relnotes.html https://www.oracle.com/java/technologies/javase/25-0-3-relnotes.html
OpenJDK-8 upstream commit: https://github.com/openjdk/jdk8u/commit/cbb90f85ecf9c9eedd9029b56f40e61555eba11a OpenJDK-11 upstream commit: https://github.com/openjdk/jdk11u/commit/7e27a5dfb71b7fbdcc8e29af5ef30b33acbf617d OpenJDK-17 upstream commit: https://github.com/openjdk/jdk17u/commit/19151db40c0676335ec6800af1dbb41f836be437 OpenJDK-21 upstream commit: https://github.com/openjdk/jdk21u/commit/1836962397f3e491b4087cfd04f4b50334d5864c OpenJDK-25 upstream commit: https://github.com/openjdk/jdk25u/commit/9bd24eb61831604c6c7437b5afdf0d06e08a73f3
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:22139 https://access.redhat.com/errata/RHSA-2026:22139