Fedora Account System
Red Hat Associate
Red Hat Customer
Vulnerability in Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 10 Via RHSA-2026:88347 https://access.redhat.com/errata/RHSA-2026:88347
This issue has been addressed in the following products: Red Hat Build of OpenJDK 21.0.12.1 Via RHSA-2026:88350 https://access.redhat.com/errata/RHSA-2026:88350
This issue has been addressed in the following products: Red Hat Build of OpenJDK 21.0.13 Via RHSA-2026:88351 https://access.redhat.com/errata/RHSA-2026:88351
This issue has been addressed in the following products: Red Hat Build of OpenJDK 25.0.5 Via RHSA-2026:88348 https://access.redhat.com/errata/RHSA-2026:88348
This issue has been addressed in the following products: Temurin Build of OpenJDK 25.0.4.1 Via RHSA-2026:90912 https://access.redhat.com/errata/RHSA-2026:90912
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Red Hat Enterprise Linux 10 Via RHSA-2026:90504 https://access.redhat.com/errata/RHSA-2026:90504
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Red Hat Enterprise Linux 9.6 Extended Update Support Red Hat Enterprise Linux 9 Via RHSA-2026:88349 https://access.redhat.com/errata/RHSA-2026:88349
This CVE was fixed in Oracle Java SE 21.0.13, 25.0.5. https://www.oracle.com/java/technologies/javase/21-0-13-relnotes.html https://www.oracle.com/java/technologies/javase/25-0-5-relnotes.html
OpenJDK-25 upstream commit: https://github.com/openjdk/jdk25u/commit/c55905941d154ecffb26485b65b0d506350defbe OpenJDK-21 upstream commit: https://github.com/openjdk/jdk21u/commit/b887608dbb7f4056c9b6f960134877b9832e4b8f