Fedora Account System
Red Hat Associate
Red Hat Customer
The initial challenge is sent in cleartext. An attacker can modify the iteration count resulting in key recovery or kinit running for a long time.
This CVE was fixed in Oracle Java SE 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3. https://www.oracle.com/java/technologies/javase/8u491-relnotes.html#R180_491 https://www.oracle.com/java/technologies/javase/11-0-31-relnotes.html#R11_0_31 https://www.oracle.com/java/technologies/javase/17-0-19-relnotes.html#R17_0_19 https://www.oracle.com/java/technologies/javase/21-0-11-relnotes.html https://www.oracle.com/java/technologies/javase/25-0-3-relnotes.html
OpenJDK-8 upstream commit: https://github.com/openjdk/jdk8u/commit/0350a82de6f1f642fd52254c08e40e63dc46b6c0 OpenJDK-11 upstream commit: https://github.com/openjdk/jdk11u/commit/1304f38a2c9922be8b2e973826af38e347171167 OpenJDK-17 upstream commit: https://github.com/openjdk/jdk17u/commit/16a319fcd5063c719a916ba3f6a8b566978592b2 OpenJDK-21 upstream commit: https://github.com/openjdk/jdk21u/commit/f0cf242663c22a2efba951563b23830766cd5a12 OpenJDK-25 upstream commit: https://github.com/openjdk/jdk25u/commit/52eab3b7d44b822fd7c48d681abc4d775d14a548
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:22139 https://access.redhat.com/errata/RHSA-2026:22139
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 10.2 Extended Update Support Via RHSA-2026:22328 https://access.redhat.com/errata/RHSA-2026:22328