Fedora Account System
Red Hat Associate
Red Hat Customer
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
OpenJDK upstream advisory provides more details: https://openjdk.org/groups/vulnerability/advisories/2026-10-21 OpenJDK fix: https://github.com/openjdk/jdk/commit/22bc7357ce6bc5f1ed2f1e83e0544b2c25f781d4
Sonatype reported, that the OpenJDK / Oracle JDK fix blacklisting specific intermediate certificates can be bypassed: https://www.sonatype.com/blog/the-limits-of-fingerprint-blocklists-a-reproducible-java-certificate-bypass
Mitigation instructions originally included in the OpenJDK upstream advisory: https://openjdk.org/groups/vulnerability/advisories/2026-10-21 involved downloading blocked.certs file with eMudhra intermediate certificates included. After the Sonatype report, those instructions were removed and replaced by instructions to remove root certificates form the cacert store published at: https://openjdk.org/emudhra
As the fix to block only affected intermediate certificates was found to be insufficient, a new advisory was released addressing this problem by removing eMudhra related root CA certificates. New CVE CVE-2026-114820 was assigned for the new fix. https://openjdk.org/groups/vulnerability/advisories/2026-10-24 https://www.oracle.com/security-alerts/alert-cve-2026-114820.html
This issue has been addressed in the following products: Red Hat Build of OpenJDK 17.0.20.1 Via RHSA-2026:89916 https://access.redhat.com/errata/RHSA-2026:89916
This issue has been addressed in the following products: Red Hat Build of OpenJDK 17.0.21 Via RHSA-2026:88353 https://access.redhat.com/errata/RHSA-2026:88353
This issue has been addressed in the following products: Red Hat Build of OpenJDK 21.0.12.1 Via RHSA-2026:88350 https://access.redhat.com/errata/RHSA-2026:88350
This issue has been addressed in the following products: Red Hat Build of OpenJDK 21.0.13 Via RHSA-2026:88351 https://access.redhat.com/errata/RHSA-2026:88351
This issue has been addressed in the following products: Red Hat Build of OpenJDK 25.0.5 Via RHSA-2026:88348 https://access.redhat.com/errata/RHSA-2026:88348
This issue has been addressed in the following products: Temurin Build of OpenJDK 25.0.4.1 Via RHSA-2026:90912 https://access.redhat.com/errata/RHSA-2026:90912
is there a reason why this is a "Will not fix" in Red Hat Enterprise Linux 8,9,10 for all java-*-openjdk according to https://access.redhat.com/security/cve/cve-2026-91403 ?
(In reply to Klaas Weyermann from comment #12) > is there a reason why this is a "Will not fix" in Red Hat Enterprise Linux > 8,9,10 for all java-*-openjdk according to > https://access.redhat.com/security/cve/cve-2026-91403 ? Multiple: - OpenJDK packages in RHEL use ca-certificates as a provider of the root CA certificate bundle. The ca-certificates with the fix for CVE-2026-114406 removing all root CAs that signed eMudhra weak intermediates is sufficient to address the problem for OpenJDK RPMs in RHEL. - CVE-2026-91403 was assigned to a fix that attempted to block eMudhra intermediates only without removing any root CAs. However, that fix was quickly bypassed - see comment 2 above - and hence a new update was prepared for OpenJDK / Oracle Java removing root CAs, with the new CVE CVE-2026-114820 - see comment 4 above. As CVE-2026-91403 refers to a fix that was found to be broken, there's no plan to issue RHEL updates with that CVE. Related to the eMudhra incident, Red Hat is only releasing updates for "Red Hat build of OpenJDK" product, which is different from OpenJDK packages in RHEL. OpenJDK builds in those product do not use ca-certificates and hence need to be patched directly. We are listing both CVE-2026-91403 and CVE-2026-114820 in those updates, as both change are included.