Bug 2460038 (CVE-2026-22007) - CVE-2026-22007 openjdk: Enhance crypto algorithm support (Oracle CPU 2026-04)
Summary: CVE-2026-22007 openjdk: Enhance crypto algorithm support (Oracle CPU 2026-04)
Keywords:
Status: NEW
Alias: CVE-2026-22007
Deadline: 2026-04-21
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-21 10:03 UTC by OSIDB Bzimport
Modified: 2026-05-27 12:49 UTC (History)
9 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-04-21 10:03:39 UTC 
3DES salt generation has a weakness when keys are repeated.
Comment 1 Michal Findra 2026-04-23 08:59:24 UTC 
This CVE was fixed in Oracle Java SE 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3. 

https://www.oracle.com/java/technologies/javase/8u491-relnotes.html#R180_491
https://www.oracle.com/java/technologies/javase/11-0-31-relnotes.html#R11_0_31
https://www.oracle.com/java/technologies/javase/17-0-19-relnotes.html#R17_0_19
https://www.oracle.com/java/technologies/javase/21-0-11-relnotes.html
https://www.oracle.com/java/technologies/javase/25-0-3-relnotes.html
Comment 2 Michal Findra 2026-04-23 09:06:04 UTC 
OpenJDK-8 upstream commit:
https://github.com/openjdk/jdk8u/commit/b3af3d582429fcfff98e50fe434049b726d6acb5

OpenJDK-11 upstream commit:
https://github.com/openjdk/jdk11u/commit/aa51a2af5fe9edd10ebfaf0b98a24e66025bfe73

OpenJDK-17 upstream commit:
https://github.com/openjdk/jdk17u/commit/6927a870e22bb33ad36bc50dfc61ad55c38050db

OpenJDK-21 upstream commit:
https://github.com/openjdk/jdk21u/commit/00eba524bbb835cf6817c83026a70ea1e9919074

OpenJDK-25 upstream commit:
https://github.com/openjdk/jdk25u/commit/f5d1128ebd099aae8b5ee615acee63cd49de47b2
Note You need to log in before you can comment on or make changes to this bug.