Bug 2376785 (CVE-2025-50059) - CVE-2025-50059 openjdk: Improve HTTP client header handling (Oracle CPU 2025-07)
Summary: CVE-2025-50059 openjdk: Improve HTTP client header handling (Oracle CPU 2025-07)
Keywords:
Status: NEW
Alias: CVE-2025-50059
Deadline: 2025-07-15
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-07-07 10:50 UTC by OSIDB Bzimport
Modified: 2026-01-21 20:21 UTC (History)
10 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:0934 0 None None None 2026-01-21 20:21:51 UTC

Description OSIDB Bzimport 2025-07-07 10:50:32 UTC 
The HTTP client leaks sensitive information when redirecting to a
different domain.
Comment 1 Michal Findra 2025-07-25 11:11:10 UTC 
OpenJDK-11 upstream commit:
https://github.com/openjdk/jdk11u/commit/ae39653f6db1e1a20ae441446b75d72f16f2fb46

OpenJDK-17 upstream commit:
https://github.com/openjdk/jdk17u/commit/770ad1fa038d4df857f4c769580ed27bb5d211e6

OpenJDK-21 upstream commit:
https://github.com/openjdk/jdk21u/commit/2494864948c3033fc4ad266fa44b054d1bbb3c7e
Comment 2 Michal Findra 2025-07-25 12:40:52 UTC 
This CVE was fixed in Oracle Java 11.0.28, 17.0.16, 21.0.8. 

https://www.oracle.com/java/technologies/javase/11-0-28-relnotes.html#R11_0_28
https://www.oracle.com/java/technologies/javase/17-0-16-relnotes.html#R17_0_16
https://www.oracle.com/java/technologies/javase/21-0-8-relnotes.html
Comment 4 errata-xmlrpc 2026-01-21 20:21:50 UTC 
This issue has been addressed in the following products:

  RHOSS-1.36-RHEL-8

Via RHSA-2026:0934 https://access.redhat.com/errata/RHSA-2026:0934
Note You need to log in before you can comment on or make changes to this bug.