OPENSUSE-SU-2026:21467-1
Vulnerability from csaf_opensuse - Published: 2026-07-28 16:12 - Updated: 2026-09-17 17:40Summary
Security update for java-25-openjdk
Severity
Important
Notes
Title of the patch: Security update for java-25-openjdk
Description of the patch: This update for java-25-openjdk fixes the following issues:
- CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize (bsc#1264994).
- CVE-2026-46917: partial denial of service via TLS (bsc#1272223).
- CVE-2026-46968: unauthorized creation, deletion or modification access to critical data (bsc#1272224).
- CVE-2026-47010: unauthorized update, insert or delete access (bsc#1272225).
- CVE-2026-47021: partial denial of service via multiple network protocols (bsc#1272227).
- CVE-2026-47027: partial denial of service via multiple network protocols (bsc#1272228).
- CVE-2026-47059: partial denial of service via multiple network protocols (bsc#1272235).
- CVE-2026-47063: unauthorized creation, deletion or modification access to critical data (bsc#1272236).
- CVE-2026-60147: unauthorized update, insert or delete access (bsc#1272237).
Changes for java-25-openjdk:
- Update to upstream tag jdk-25.0.4+7 (July 2026 CPU):
+ JDK-7184899: Test sun/java2d/X11SurfaceData/
/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail
+ JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes
fails
+ JDK-8064922: [macos] Test javax/swing/JTabbedPane/4624207/
/bug4624207.java fails
+ JDK-8068293: [TEST_BUG] Test closed/com/sun/java/swing/plaf/
/motif/InternalFrame/4150591/bug4150591.java fails with
GTKLookAndFeel
+ JDK-8068310: [TEST_BUG] Test javax/swing/JColorChooser/
/Test4234761.java fails with GTKL&F
+ JDK-8144124: [macosx] The tabs can't be aligned when we
pressing the key of 'R','B','L','C' or 'T'.
+ JDK-8203004: UnixMultiResolutionSplashTest.java fails on
Ubuntu16.04
+ JDK-8213530: Test java/awt/Modal/ToFront/
/DialogToFrontModeless1Test.java fails on Linux
+ JDK-8221451: PIT: sun/java2d/X11SurfaceData/
/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fails
+ JDK-8225787: java/awt/Window/GetScreenLocation/
/GetScreenLocationTest.java fails on Ubuntu
+ JDK-8241066: Shenandoah: fix or cleanup SH::do_full_collection
+ JDK-8261743: Shenandoah: enable String deduplication with
compact heuristics
+ JDK-8264851: Shenandoah: Rework control loop mechanics to use
timed waits
+ JDK-8278102: containers/docker/TestJcmd.java failed with
"RuntimeException: Could not find specified process"
+ JDK-8279196: Test: jdk/jfr/event/gc/stacktrace/
/TestG1OldAllocationPendingStackTrace.java timed out
+ JDK-8297191: [macos] Printing a page range with starting
page > 1 results in missing pages
+ JDK-8298823: [macos] java/awt/Mouse/EnterExitEvents/
/DragWindowTest.java continues to fail with "No MouseReleased
event on label!"
+ JDK-8319326: GC: Make TestParallelRefProc use
createTestJavaProcessBuilder
+ JDK-8319540: GC: Make TestSelectDefaultGC use
+ JDK-8321303: Intermittent open/test/jdk/java/awt/
/KeyboardFocusmanager/ConsumeNextMnemonicKeyTypedTest/
/ConsumeNextMnemonicKeyTypedTest.java failure on Linux
+ JDK-8321687: Test vmTestbase/nsk/jvmti/scenarios/contention/
/TC03/tc03t002/TestDescription.java failed:
JVMTI_ERROR_THREAD_NOT_ALIVE
+ JDK-8323792: ThreadSnapshot::initialize can cause assert in
Thread::check_for_dangling_thread_pointer (possibility of
dangling Thread pointer)
+ JDK-8325482: Test that distinct seeds produce distinct traces
for compiler stress flags
+ JDK-8335355: Shenandoah: Fix race condition in gc/shenandoah/
/mxbeans/TestPauseNotifications.java
+ JDK-8339526: C2: store incorrectly removed for clone()
transformed to series of loads/stores
+ JDK-8340182: Java HttpClient does not follow default retry
limit of 3 retries
+ JDK-8341735: Rewrite the build/AbsPathsInImage.java test to
not load the entire file at once
+ JDK-8344345: test/hotspot/gtest/x86/x86-asmtest.py has
trailing whitespaces
+ JDK-8345631: TestRegionSamplingLogging.java
#generational-rotation intermittent fails
+ JDK-8347167: Reduce allocation in
com.sun.net.httpserver.Headers::normalize
+ JDK-8347938: Add Support for the Latest ML-KEM and ML-DSA
Private Key Encodings
+ JDK-8351010: Test java/io/File/GetXSpace.java failed: / usable
space 56380809216 > free space 14912244940
+ JDK-8352914: Shenandoah: Change definition of
ShenandoahSharedValue to int32_t to leverage platform atomics
+ JDK-8353115: GenShen: mixed evacuation candidate regions need
accurate live_data
+ JDK-8354650: [PPC64] Try to reduce register definitions
+ JDK-8355339: Test java/io/File/GetCanonicalPath.java failed:
The specified network name is no longer available
+ JDK-8357086: os::xxx functions returning memory size should
return size_t
+ JDK-8358600: Template-Framework Library: Template for
TestFramework test class
+ JDK-8358772: Template-Framework Library: Primitive Types
+ JDK-8359083: Test jdkCheckHtml.java should report
SkippedException rather than report fails when miss tidy
+ JDK-8359223: HttpClient: Remove leftovers from the
SecurityManager cleanup
+ JDK-8359412: Template-Framework Library: Operations and
Expressions
+ JDK-8359433: The final modifier on Windows L&F internal UI
classes prevents extending them in apps
+ JDK-8361339: Test gc/shenandoah/TestLargeObjectAlignment.java
#generational fails on macOS aarch64 with OOM: Java heap space
+ JDK-8361606: ConsumeNextMnemonicKeyTypedTest.java fails on
Windows: character typed with VK_A: a
+ JDK-8361699: C2: assert(can_reduce_phi(n->as_Phi())) failed:
Sanity: previous reducible Phi is no longer reducible before
SUT
+ JDK-8361726: Shenandoah: More detailed evacuation
instrumentation
+ JDK-8362428: Update IANA Language Subtag Registry to Version
2025-08-25
+ JDK-8363943: ARM32: Represent Registers as values
+ JDK-8363949: Incorrect jtreg header in
MonitorWithDeadObjectTest.java
+ JDK-8363986: Heap region in CDS archive is not at
deterministic address
+ JDK-8364315: Remove unused xml files from test/jaxp/javax/xml/
/jaxp/functional/javax/xml/transform/xmlfiles
+ JDK-8364657: Crash for SecureRandom.generateSeed(0) on Windows
x86-64
+ JDK-8364927: Add @requires annotation to
TestReclaimStringsLeaksMemory.java
+ JDK-8365057: Add support for java.util.concurrent lock
information to Thread.dump_to_file
+ JDK-8365379: SU3.applyInsets may produce wrong results
+ JDK-8365423: [macos26] java/awt/MenuBar/8007006/
/bug8007006.java fails on macOS 26
+ JDK-8365424: [macos26] java/awt/Frame/DisposeTest.java fails
on macOS 26
+ JDK-8365623: test/jdk/sun/security/pkcs11/tls/ tests skipped
without skip exception
+ JDK-8365625: Can't change accelerator colors in Windows L&F
+ JDK-8365792: GenShen: assertion "Generations aren't
reconciled"
+ JDK-8366692: Several gc/shenandoah tests timed out
+ JDK-8366695: Test sun/jvmstat/monitor/MonitoredVm/
/MonitorVmStartTerminate.java timed out
+ JDK-8366852: java/awt/Choice/ChoiceMouseWheelTest/
/ChoiceMouseWheelTest.java test is failing
+ JDK-8367096: jdk/open/test/jdk/sun/security/pkcs11/ rsa, ec,
config, secmod and sslecc tests are skipping but showing as
pass
+ JDK-8367450: Shenandoah: Log the composition of the collection
set
+ JDK-8367451: GenShen: Remove the option to compute age census
during evacuation
+ JDK-8367473: Shenandoah: Make the detailed evacuation metrics
a runtime diagnostic option
+ JDK-8367485: os::physical_memory is broken in 32-bit JVMs when
running on 64-bit OSes
+ JDK-8367531: Template Framework: use scopes and tokens instead
of misbehaving immediate-return-queries
+ JDK-8367646: [GenShen] Control thread may overwrite gc
cancellation cause set by mutator
+ JDK-8367708: GenShen: Reduce total evacuation burden
+ JDK-8367709: GenShen: Dirty cards for objects that get
promoted by safepoint that intervenes between allocation and
stores
+ JDK-8367722: [GenShen] ShenandoahEvacuationStats is always
empty
+ JDK-8367949: JFR: MethodTrace double-counts methods that catch
their own exceptions
+ JDK-8368001: java/text/Format/NumberFormat/
/NumberRoundTrip.java timed out
+ JDK-8368015: Shenandoah: fix error in computation of average
allocation rate
+ JDK-8368041: Enhance TLS certificate handling
+ JDK-8368159: Significant performance overhead when started
with jdwp agent and unattached debugger
+ JDK-8368181: ProblemList java/awt/Dialog/ModalExcludedTest/
/ModalExcludedTest.java
+ JDK-8368307: Shenandoah: get_next_bit_impl should special case
weak and strong mark bits
+ JDK-8368499: GenShen: Do not collect age census during evac
when adaptive tenuring is disabled
+ JDK-8368501: Shenandoah: GC progress evaluation does not use
generation
+ JDK-8368524: Tests are skipped and shown as passed in test/
/jdk/sun/security/pkcs11/Cipher/KeyWrap
+ JDK-8368681: Shenandoah: Add documentation comments for
ShenandoahAllocationRate
+ JDK-8369128: ProblemList jdk/jfr/event/profiling/
/TestCPUTimeSampleQueueAutoSizes.java in Xcomp configs
+ JDK-8369132: Disable vmTestbase/gc/vector/CircularListLow and
LinearListLow with SerialGC
+ JDK-8369133: Disable gc/g1/TestShrinkAuxiliaryDataRunner.java
with UseLargePages option
+ JDK-8369251: Opensource few tests
+ JDK-8369561: sun/java2d/OpenGL/DrawBitmaskImage.java#id0:
Incorrect color for first pixel (actual=ff000000)
+ JDK-8369683: Exclude runtime/Monitor/
/MonitorWithDeadObjectTest.java#DumpThreadsBeforeDetach on
Alpine Linux debug
+ JDK-8369736: Add management interface for AOT cache creation
+ JDK-8369817: [TESTBUG] EmptyPath::toString is ignored
+ JDK-8369912: [TESTBUG] testlibrary_tests/template_framework/
/examples/TestExpressions.java fails with ArithmeticException:
/ by zero - forgot to respect Expression.info
+ JDK-8369950: TLS connection to IPv6 address fails with BCJSSE
due to IllegalArgumentException
+ JDK-8370370: Add still more cases to WorstCaseTests
+ JDK-8370489: Some compiler tests miss the @key randomness
+ JDK-8370502: C2: segfault while adding node to IGVN worklist
+ JDK-8370521: GenShen: Various code cleanup related to
promotion
+ JDK-8370939: C2: SIGSEGV in SafePointNode::verify_input when
processing MH call from
Compile::process_late_inline_calls_no_inline()
+ JDK-8371284: GenShen: Avoid unnecessary card marking
+ JDK-8371381: [Shenandoah] Setting ergo flags should use
FLAG_SET_ERGO
+ JDK-8371503: RETAIN_IMAGE_AFTER_TEST do not work for some
tests
+ JDK-8371792: Refactor barrier loop tests out of TestIfMinMax
+ JDK-8371893: [macOS] use dead_strip linker option to reduce
binary size
+ JDK-8372272: Hotspot shared lib loading - add load attempts to
Events::log
+ JDK-8372351: Add 2 WISeKey roots
+ JDK-8372380: Make hs_err reporting more robust for unattached
threads
+ JDK-8372513: Shenandoah: ShenandoahMaxRegionSize can produce
an unaligned heap alignment
+ JDK-8372851: Modify java/io/File/GetXSpace.java to print path
on failure of native call
+ JDK-8372861: Genshen: Override parallel_region_stride of
ShenandoahResetBitmapClosure to a reasonable value for better
parallelism
+ JDK-8373039: Remove Incorrect Asserts in
shenandoahScanRemembered
+ JDK-8373120: Virtual thread stuck in BLOCKED state
+ JDK-8373239: Test java/awt/print/PrinterJob/PageRanges.java
fails with incorrect selection of printed pages
+ JDK-8373275: Improve DTLS handshaking
+ JDK-8373515: Migrate "test/jdk/java/net/httpclient/" to
null-safe "SimpleSSLContext" methods
+ JDK-8373579: Problem list compiler/runtime/Test7196199.java
+ JDK-8373650: Test "javax/swing/JMenuItem/6458123/
/ManualBug6458123.java" fails because the check icons are not
aligned properly as expected
+ JDK-8373676: Test javax/net/ssl/HttpsURLConnection/
/SubjectAltNameIP.java fails on a machine without IPV6
+ JDK-8373690: Unexpected Keystore message using
jdk.crypto.disabledAlgorithms
+ JDK-8373714: Shenandoah: Register heuristic penalties
following a degenerated GC
+ JDK-8373718: jdk/internal/misc/VM/RuntimeArguments.java test
fails in Virtual threads mode
+ JDK-8373796: Refactor java/net/httpclient/
/ThrowingPublishers*.java tests to use JUnit5
+ JDK-8373847: Test javax/swing/JMenuItem/MenuItemTest/
/bug6197830.java failed because The test case automatically
fails when clicking any items in the "Nothing" menu in all
four windows (Left-to-right)-Menu Item Test and
(Right-to-left)-Menu Item Test
+ JDK-8373866: Refactor java/net/httpclient/
/ThrowingSubscribers*.java tests to use JUnit5
+ JDK-8373893: Refactor networking http server tests to use
JUnit
+ JDK-8373913: Refactor serialization tests to use JUnit
+ JDK-8373928: 4 Dangling pointer defect groups in java.c
+ JDK-8374001: sun/security/ skip without Exceptions
+ JDK-8374058: Enhance JPEG handling
+ JDK-8374168: Resolve disabled warnings in JDWP agent
+ JDK-8374304: MultiResolutionSplashTest.java fails in CI:
"Image with wrong resolution is used for splash screen!"
+ JDK-8374322: TestMemoryWithSubgroups.java fails Permission
denied
+ JDK-8374343: Fix SIGSEGV when lib/modules is unreadable
+ JDK-8374449: Shenandoah: Leaf locks used by Shenandoah need
lower ranks
+ JDK-8374506: Incorrect positioning of arrow icon in parent
JMenu in Windows L&F
+ JDK-8374712: AOTMappedHeapWriter::relocate_field_in_buffer
should use CompressedOops::narrow_oop_cast
+ JDK-8374727: Audio configuration Platform class - use nio for
getting endianness of the underlying platform
+ JDK-8374744: Enable dumping of APX EGPRs (R16--R31) in JVM
fatal error logs
+ JDK-8374769: PPC: MASM::pop_cont_fastpath() should reset
_cont_fastpath if SP == _cont_fastpath
+ JDK-8374888: Implement internal test cache to help
UserIterCount test performance
+ JDK-8374998: Failing os::write - remove bad file
+ JDK-8375065: Update LCMS to 2.18
+ JDK-8375177: Gtest
os_linux.decoder_get_source_info_valid_vm fails with
-ffunction-sections
+ JDK-8375294: (fs) Files.copy can fail with EOPNOTSUPP when
copy_file_range not supported
+ JDK-8376031: HttpsURLConnection.getServerCertificates() throws
"java.lang.IllegalStateException: connection not yet open" for
the HEAD method
+ JDK-8376104: C2 crashes in PhiNode::Ideal(PhaseGVN*, bool)
accessing NULL pointer
+ JDK-8376151: Test javax/swing/JFileChooser/4966171/
/bug4966171.java is failing with OOME
+ JDK-8376152: Test javax/sound/sampled/Clip/bug5070081.java
timed out then completed
+ JDK-8376185: NoSuchFieldError thrown after a record with type
annotation retransformed
+ JDK-8376233: Clean up code in Desktop native peer
+ JDK-8376287: Crashes when using -XX:ObjArrayMarkingStride=0
+ JDK-8376402: Dependencies::print_statistics() and
AbstractClassHierarchyWalker::print_statistics() are not
called from PRODUCT code
+ JDK-8376684: Compile OpenJDK in headless mode without required
X11 libraries
+ JDK-8376956: Add JVMTI phase entering/setting to hserr event
log
+ JDK-8376969: Shenandoah: GC state getters should be inlineable
+ JDK-8376970: Shenandoah: Verifier should do basic verification
before touching oops
+ JDK-8377158: Enhance XBM image support
+ JDK-8377167: javax/imageio/ReadAbortTest.java throw NPE when
x11 unavailable
+ JDK-8377498: Improve HttpServer handling
+ JDK-8377512: AOT cache creation fails with invalid native
pointer
+ JDK-8377602: Create automated test for PageRange
+ JDK-8377727: Ghost caret and focus appear in non-editable
text fields
+ JDK-8377833: Enhance Jar file processing
+ JDK-8377907: (process) Race in ProcessBuilder can cause JVM
hangs
+ JDK-8377910: Minor cleanup of java/io/FileDescriptor/
/Sharing.java
+ JDK-8377932: AOT cache is not rejected when JAR file has
changed
+ JDK-8377944: LowMemoryTest2.java#id1 intermittent fails OOME:
Metaspace
+ JDK-8377949: TestZRelocationSetEvent.java intermittent fails
OOME
+ JDK-8378083: Mark shenandoah/generational/
/TestOldGrowthTriggers.java as flagless
+ JDK-8378201: [OGL] glXMakeContextCurrent() drops the buffers
of the unbound drawable
+ JDK-8378417: Printing All pages results in NPE for 1.1
PrintJob
+ JDK-8378561: Mark gc/shenandoah/compiler/
/TestLinkToNativeRBP.java as /native
+ JDK-8378687: Improve delegation of HttpURLConnection
+ JDK-8378727: [macOS] Missing dispatch_release for semaphores
in CDesktopPeer
+ JDK-8378746: ZGC: jdk/jfr/event/gc/detailed/
/TestZRelocationSetGroupEvent.java intermittent OOME
+ JDK-8378764: fileStream::fileSize() fails for >2GB files on
Windows
+ JDK-8378774: Bump update version for OpenJDK: jdk-25.0.4
+ JDK-8378810: Enable missing FFM test via jtreg requires for
RISC-V
+ JDK-8378836: Enable linktime-gc by default on Linux ppc64le
+ JDK-8378878: Refactor java/nio/channels/
/AsynchronousSocketChannel test to use JUnit
+ JDK-8378888: jdk/incubator/vector/
/Float16OperationsBenchmark.java uses wrong package name
+ JDK-8379021: Shenandoah: Speedup ShenandoahSimpleBitMapTest
+ JDK-8379202: Support linktime-gc on Linux with clang
+ JDK-8379416: AIX build fails if system (not GNU) date tool is
in PATH
+ JDK-8379425: Windows and macOS should not allow unsupported
headless-only build
+ JDK-8379457: Test EATests.java#id0 ERROR: monitor list errors:
error_cnt=1
+ JDK-8379464: Enable missing stack walking test via jtreg
requires for RISC-V
+ JDK-8379499: [AIX] headless-only build of libjawt.so fails
+ JDK-8379515: draft-ietf-lamps-kyber-certificates is now
RFC 9935
+ JDK-8380011: Path-to-gcroots search should not trigger stack
overflows
+ JDK-8380041: PPC: remove POWER6 remnants
+ JDK-8380222: Refactor test/jdk/java/lang/Character TestNG
tests to JUnit
+ JDK-8380316: Test runtime/os/AvailableProcessors.java fails
Invalid argument
+ JDK-8380409: JVM crashes when -XX:AOTMode=create uses
app.aotconf generated with JVMTI agent
+ JDK-8380428: ProblemList containers/docker/
/TestJcmdWithSideCar.java on linux-all
+ JDK-8380431: Shenandoah: Concurrent modification of
stack-chunk objects during evacuation
+ JDK-8380474: Crash SEGV in ThreadIdTable::lazy_initialize
after JDK-8323792
+ JDK-8380565: PPC64: deoptimization stub should save vector
registers
+ JDK-8380663: Update jcmd man page to include AOT.end_recording
diagnostic command
+ JDK-8380672: Improve certification checking
+ JDK-8380846: GenShen: Remove the experimental option to
disable adaptive tenuring
+ JDK-8380947: Add pull request template
+ JDK-8381039: Enhance AWT ImagingLib
+ JDK-8381049: Enhance Jar handling
+ JDK-8381205: GHA: Upgrade Node.js 20 to 24
+ JDK-8381315: compiler/vectorapi/TestVectorReallocation.java
fails with -XX:UseAVX=1 after JDK-8380565
+ JDK-8381382: Shenandoah: assert(capacity > 0) failed: free
regions must have allocation capacity
+ JDK-8381519: Enhance Der Value Handling
+ JDK-8381796: Enhance Certificate parsing
+ JDK-8381871: GenShen: ShenandoahGCHeuristics flag not reset
after ignoring non-adaptive value
+ JDK-8381935: Improve numChunks range in the PPC64 CallAranger
+ JDK-8381937: Make exceptions in
Java_sun_security_mscapi_CKeyPairGenerator generateCKeyPair
more specific
+ JDK-8382018: test/jdk/java/nio/file/spi/
/SetDefaultProvider.java leaves a directory in /tmp
+ JDK-8382020: Time Zone Abbreviation Not Localized for
Non-English Locales
+ JDK-8382035: [ubsan] Under UBSAN builds, disable tests that
rely on simulated JVM crashes
+ JDK-8382090: Remove .rej and .orig from .gitignore
+ JDK-8382242: JFR: Metadata reconstruction invalidates
ConstantMap for java.lang.String
+ JDK-8382295: Shenandoah: wrong denominator in full gc summary
+ JDK-8382395: Disable stringop-overflow in
shenandoahGenerationalHeap.cpp
+ JDK-8382419: Add missed @key randomness after JDK-8370489
+ JDK-8382522: Disable stringop-overflow in
safepointMechanism.cpp
+ JDK-8382740: JFR: Disable jdk.OldObjectSample event for
generational ZGC
+ JDK-8382878: RISC-V: Missing InlineSkippedInstructionsCounter
in ZGC barriers stubs
+ JDK-8382932: [25u] Test java/lang/instrument/
/RetransformRecordTypeAnn/TestRetransformRecord.java fails
with compilation error
+ JDK-8383161: [PPC64]
MachCallDynamicJavaNode::ret_addr_offset() needs adaptation
for COH
+ JDK-8383175: (tz) Update Timezone Data to 2026b
+ JDK-8383183: Shenandoah: Mangle trashed regions up to top
instead of end
+ JDK-8383354: Update LCMS to 2.19.1
+ JDK-8383473: Follow on from tzdata2026b time change to
include temporary hack BC time change
+ JDK-8383601: RISC-V:
ShenandoahBarrierSetAssembler::load_reference_barrier calls
"weak" on "phantom" path
+ JDK-8383630: Fix iteration in tests doing class redefinition
+ JDK-8384043: [REDO] Incorrect handling of Hawaii_Aleutian
metazone
+ JDK-8384158: GHA: Downgrade Windows GHA runners to
windows-2022 temporarily
+ JDK-8384163: (so) SocketChannel.connect and finishConnect()
exception messages could be improved
+ JDK-8384223: RISC-V: entry_barrier_offset should consider
UseZtso
+ JDK-8384486: NTLM tests fail on Windows 11 and Windows Server
2025
+ JDK-8384495: Update Libpng to 1.6.58
+ JDK-8384540: [25u, 21u, 17u] Update GHA JDKs after Apr/26
updates
+ JDK-8384815: SelectOneKeyOutOfMany and PreferredKey fail after
expired test certificate
+ JDK-8384902: Update GIFlib to 6.1.3
+ JDK-8385390: Update FreeType to 2.14.3
+ JDK-8385490: Update HarfBuzz to 14.2.0
+ JDK-8386551: Windows build broken because of MSys2/Make update
Patchnames: openSUSE-Leap-16.0-1382
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
25 products, the same list as for
CVE-2026-41254
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
25 products, the same list as for
CVE-2026-41254
Threats
Impact
moderate
Affected products
Recommended
25 products, the same list as for
CVE-2026-41254
Threats
Impact
low
5.3 (Medium)
Affected products
Recommended
25 products, the same list as for
CVE-2026-41254
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
25 products, the same list as for
CVE-2026-41254
Threats
Impact
moderate
Affected products
Recommended
25 products, the same list as for
CVE-2026-41254
Threats
Impact
low
7.5 (High)
Affected products
Recommended
25 products, the same list as for
CVE-2026-41254
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
25 products, the same list as for
CVE-2026-41254
Threats
Impact
moderate
References
39 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for java-25-openjdk",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for java-25-openjdk fixes the following issues:\n\n- CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize (bsc#1264994).\n- CVE-2026-46917: partial denial of service via TLS (bsc#1272223).\n- CVE-2026-46968: unauthorized creation, deletion or modification access to critical data (bsc#1272224).\n- CVE-2026-47010: unauthorized update, insert or delete access (bsc#1272225).\n- CVE-2026-47021: partial denial of service via multiple network protocols (bsc#1272227).\n- CVE-2026-47027: partial denial of service via multiple network protocols (bsc#1272228).\n- CVE-2026-47059: partial denial of service via multiple network protocols (bsc#1272235).\n- CVE-2026-47063: unauthorized creation, deletion or modification access to critical data (bsc#1272236).\n- CVE-2026-60147: unauthorized update, insert or delete access (bsc#1272237).\n\nChanges for java-25-openjdk:\n\n- Update to upstream tag jdk-25.0.4+7 (July 2026 CPU):\n\n + JDK-7184899: Test sun/java2d/X11SurfaceData/\n /SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail\n + JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes\n fails\n + JDK-8064922: [macos] Test javax/swing/JTabbedPane/4624207/\n /bug4624207.java fails\n + JDK-8068293: [TEST_BUG] Test closed/com/sun/java/swing/plaf/\n /motif/InternalFrame/4150591/bug4150591.java fails with\n GTKLookAndFeel\n + JDK-8068310: [TEST_BUG] Test javax/swing/JColorChooser/\n /Test4234761.java fails with GTKL\u0026F\n + JDK-8144124: [macosx] The tabs can\u0027t be aligned when we\n pressing the key of \u0027R\u0027,\u0027B\u0027,\u0027L\u0027,\u0027C\u0027 or \u0027T\u0027.\n + JDK-8203004: UnixMultiResolutionSplashTest.java fails on\n Ubuntu16.04\n + JDK-8213530: Test java/awt/Modal/ToFront/\n /DialogToFrontModeless1Test.java fails on Linux\n + JDK-8221451: PIT: sun/java2d/X11SurfaceData/\n /SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fails\n + JDK-8225787: java/awt/Window/GetScreenLocation/\n /GetScreenLocationTest.java fails on Ubuntu\n + JDK-8241066: Shenandoah: fix or cleanup SH::do_full_collection\n + JDK-8261743: Shenandoah: enable String deduplication with\n compact heuristics\n + JDK-8264851: Shenandoah: Rework control loop mechanics to use\n timed waits\n + JDK-8278102: containers/docker/TestJcmd.java failed with\n \"RuntimeException: Could not find specified process\"\n + JDK-8279196: Test: jdk/jfr/event/gc/stacktrace/\n /TestG1OldAllocationPendingStackTrace.java timed out\n + JDK-8297191: [macos] Printing a page range with starting\n page \u003e 1 results in missing pages\n + JDK-8298823: [macos] java/awt/Mouse/EnterExitEvents/\n /DragWindowTest.java continues to fail with \"No MouseReleased\n event on label!\"\n + JDK-8319326: GC: Make TestParallelRefProc use\n createTestJavaProcessBuilder\n + JDK-8319540: GC: Make TestSelectDefaultGC use\n + JDK-8321303: Intermittent open/test/jdk/java/awt/\n /KeyboardFocusmanager/ConsumeNextMnemonicKeyTypedTest/\n /ConsumeNextMnemonicKeyTypedTest.java failure on Linux\n + JDK-8321687: Test vmTestbase/nsk/jvmti/scenarios/contention/\n /TC03/tc03t002/TestDescription.java failed:\n JVMTI_ERROR_THREAD_NOT_ALIVE\n + JDK-8323792: ThreadSnapshot::initialize can cause assert in\n Thread::check_for_dangling_thread_pointer (possibility of\n dangling Thread pointer)\n + JDK-8325482: Test that distinct seeds produce distinct traces\n for compiler stress flags\n + JDK-8335355: Shenandoah: Fix race condition in gc/shenandoah/\n /mxbeans/TestPauseNotifications.java\n + JDK-8339526: C2: store incorrectly removed for clone()\n transformed to series of loads/stores\n + JDK-8340182: Java HttpClient does not follow default retry\n limit of 3 retries\n + JDK-8341735: Rewrite the build/AbsPathsInImage.java test to\n not load the entire file at once\n + JDK-8344345: test/hotspot/gtest/x86/x86-asmtest.py has\n trailing whitespaces\n + JDK-8345631: TestRegionSamplingLogging.java\n #generational-rotation intermittent fails\n + JDK-8347167: Reduce allocation in\n com.sun.net.httpserver.Headers::normalize\n + JDK-8347938: Add Support for the Latest ML-KEM and ML-DSA\n Private Key Encodings\n + JDK-8351010: Test java/io/File/GetXSpace.java failed: / usable\n space 56380809216 \u003e free space 14912244940\n + JDK-8352914: Shenandoah: Change definition of\n ShenandoahSharedValue to int32_t to leverage platform atomics\n + JDK-8353115: GenShen: mixed evacuation candidate regions need\n accurate live_data\n + JDK-8354650: [PPC64] Try to reduce register definitions\n + JDK-8355339: Test java/io/File/GetCanonicalPath.java failed:\n The specified network name is no longer available\n + JDK-8357086: os::xxx functions returning memory size should\n return size_t\n + JDK-8358600: Template-Framework Library: Template for\n TestFramework test class\n + JDK-8358772: Template-Framework Library: Primitive Types\n + JDK-8359083: Test jdkCheckHtml.java should report\n SkippedException rather than report fails when miss tidy\n + JDK-8359223: HttpClient: Remove leftovers from the\n SecurityManager cleanup\n + JDK-8359412: Template-Framework Library: Operations and\n Expressions\n + JDK-8359433: The final modifier on Windows L\u0026F internal UI\n classes prevents extending them in apps\n + JDK-8361339: Test gc/shenandoah/TestLargeObjectAlignment.java\n #generational fails on macOS aarch64 with OOM: Java heap space\n + JDK-8361606: ConsumeNextMnemonicKeyTypedTest.java fails on\n Windows: character typed with VK_A: a\n + JDK-8361699: C2: assert(can_reduce_phi(n-\u003eas_Phi())) failed:\n Sanity: previous reducible Phi is no longer reducible before\n SUT\n + JDK-8361726: Shenandoah: More detailed evacuation\n instrumentation\n + JDK-8362428: Update IANA Language Subtag Registry to Version\n 2025-08-25\n + JDK-8363943: ARM32: Represent Registers as values\n + JDK-8363949: Incorrect jtreg header in\n MonitorWithDeadObjectTest.java\n + JDK-8363986: Heap region in CDS archive is not at\n deterministic address\n + JDK-8364315: Remove unused xml files from test/jaxp/javax/xml/\n /jaxp/functional/javax/xml/transform/xmlfiles\n + JDK-8364657: Crash for SecureRandom.generateSeed(0) on Windows\n x86-64\n + JDK-8364927: Add @requires annotation to\n TestReclaimStringsLeaksMemory.java\n + JDK-8365057: Add support for java.util.concurrent lock\n information to Thread.dump_to_file\n + JDK-8365379: SU3.applyInsets may produce wrong results\n + JDK-8365423: [macos26] java/awt/MenuBar/8007006/\n /bug8007006.java fails on macOS 26\n + JDK-8365424: [macos26] java/awt/Frame/DisposeTest.java fails\n on macOS 26\n + JDK-8365623: test/jdk/sun/security/pkcs11/tls/ tests skipped\n without skip exception\n + JDK-8365625: Can\u0027t change accelerator colors in Windows L\u0026F\n + JDK-8365792: GenShen: assertion \"Generations aren\u0027t\n reconciled\"\n + JDK-8366692: Several gc/shenandoah tests timed out\n + JDK-8366695: Test sun/jvmstat/monitor/MonitoredVm/\n /MonitorVmStartTerminate.java timed out\n + JDK-8366852: java/awt/Choice/ChoiceMouseWheelTest/\n /ChoiceMouseWheelTest.java test is failing\n + JDK-8367096: jdk/open/test/jdk/sun/security/pkcs11/ rsa, ec,\n config, secmod and sslecc tests are skipping but showing as\n pass\n + JDK-8367450: Shenandoah: Log the composition of the collection\n set\n + JDK-8367451: GenShen: Remove the option to compute age census\n during evacuation\n + JDK-8367473: Shenandoah: Make the detailed evacuation metrics\n a runtime diagnostic option\n + JDK-8367485: os::physical_memory is broken in 32-bit JVMs when\n running on 64-bit OSes\n + JDK-8367531: Template Framework: use scopes and tokens instead\n of misbehaving immediate-return-queries\n + JDK-8367646: [GenShen] Control thread may overwrite gc\n cancellation cause set by mutator\n + JDK-8367708: GenShen: Reduce total evacuation burden\n + JDK-8367709: GenShen: Dirty cards for objects that get\n promoted by safepoint that intervenes between allocation and\n stores\n + JDK-8367722: [GenShen] ShenandoahEvacuationStats is always\n empty\n + JDK-8367949: JFR: MethodTrace double-counts methods that catch\n their own exceptions\n + JDK-8368001: java/text/Format/NumberFormat/\n /NumberRoundTrip.java timed out\n + JDK-8368015: Shenandoah: fix error in computation of average\n allocation rate\n + JDK-8368041: Enhance TLS certificate handling\n + JDK-8368159: Significant performance overhead when started\n with jdwp agent and unattached debugger\n + JDK-8368181: ProblemList java/awt/Dialog/ModalExcludedTest/\n /ModalExcludedTest.java\n + JDK-8368307: Shenandoah: get_next_bit_impl should special case\n weak and strong mark bits\n + JDK-8368499: GenShen: Do not collect age census during evac\n when adaptive tenuring is disabled\n + JDK-8368501: Shenandoah: GC progress evaluation does not use\n generation\n + JDK-8368524: Tests are skipped and shown as passed in test/\n /jdk/sun/security/pkcs11/Cipher/KeyWrap\n + JDK-8368681: Shenandoah: Add documentation comments for\n ShenandoahAllocationRate\n + JDK-8369128: ProblemList jdk/jfr/event/profiling/\n /TestCPUTimeSampleQueueAutoSizes.java in Xcomp configs\n + JDK-8369132: Disable vmTestbase/gc/vector/CircularListLow and\n LinearListLow with SerialGC\n + JDK-8369133: Disable gc/g1/TestShrinkAuxiliaryDataRunner.java\n with UseLargePages option\n + JDK-8369251: Opensource few tests\n + JDK-8369561: sun/java2d/OpenGL/DrawBitmaskImage.java#id0:\n Incorrect color for first pixel (actual=ff000000)\n + JDK-8369683: Exclude runtime/Monitor/\n /MonitorWithDeadObjectTest.java#DumpThreadsBeforeDetach on\n Alpine Linux debug\n + JDK-8369736: Add management interface for AOT cache creation\n + JDK-8369817: [TESTBUG] EmptyPath::toString is ignored\n + JDK-8369912: [TESTBUG] testlibrary_tests/template_framework/\n /examples/TestExpressions.java fails with ArithmeticException:\n / by zero - forgot to respect Expression.info\n + JDK-8369950: TLS connection to IPv6 address fails with BCJSSE\n due to IllegalArgumentException\n + JDK-8370370: Add still more cases to WorstCaseTests\n + JDK-8370489: Some compiler tests miss the @key randomness\n + JDK-8370502: C2: segfault while adding node to IGVN worklist\n + JDK-8370521: GenShen: Various code cleanup related to\n promotion\n + JDK-8370939: C2: SIGSEGV in SafePointNode::verify_input when\n processing MH call from\n Compile::process_late_inline_calls_no_inline()\n + JDK-8371284: GenShen: Avoid unnecessary card marking\n + JDK-8371381: [Shenandoah] Setting ergo flags should use\n FLAG_SET_ERGO\n + JDK-8371503: RETAIN_IMAGE_AFTER_TEST do not work for some\n tests\n + JDK-8371792: Refactor barrier loop tests out of TestIfMinMax\n + JDK-8371893: [macOS] use dead_strip linker option to reduce\n binary size\n + JDK-8372272: Hotspot shared lib loading - add load attempts to\n Events::log\n + JDK-8372351: Add 2 WISeKey roots\n + JDK-8372380: Make hs_err reporting more robust for unattached\n threads\n + JDK-8372513: Shenandoah: ShenandoahMaxRegionSize can produce\n an unaligned heap alignment\n + JDK-8372851: Modify java/io/File/GetXSpace.java to print path\n on failure of native call\n + JDK-8372861: Genshen: Override parallel_region_stride of\n ShenandoahResetBitmapClosure to a reasonable value for better\n parallelism\n + JDK-8373039: Remove Incorrect Asserts in\n shenandoahScanRemembered\n + JDK-8373120: Virtual thread stuck in BLOCKED state\n + JDK-8373239: Test java/awt/print/PrinterJob/PageRanges.java\n fails with incorrect selection of printed pages\n + JDK-8373275: Improve DTLS handshaking\n + JDK-8373515: Migrate \"test/jdk/java/net/httpclient/\" to\n null-safe \"SimpleSSLContext\" methods\n + JDK-8373579: Problem list compiler/runtime/Test7196199.java\n + JDK-8373650: Test \"javax/swing/JMenuItem/6458123/\n /ManualBug6458123.java\" fails because the check icons are not\n aligned properly as expected\n + JDK-8373676: Test javax/net/ssl/HttpsURLConnection/\n /SubjectAltNameIP.java fails on a machine without IPV6\n + JDK-8373690: Unexpected Keystore message using\n jdk.crypto.disabledAlgorithms\n + JDK-8373714: Shenandoah: Register heuristic penalties\n following a degenerated GC\n + JDK-8373718: jdk/internal/misc/VM/RuntimeArguments.java test\n fails in Virtual threads mode\n + JDK-8373796: Refactor java/net/httpclient/\n /ThrowingPublishers*.java tests to use JUnit5\n + JDK-8373847: Test javax/swing/JMenuItem/MenuItemTest/\n /bug6197830.java failed because The test case automatically\n fails when clicking any items in the \"Nothing\" menu in all\n four windows (Left-to-right)-Menu Item Test and\n (Right-to-left)-Menu Item Test\n + JDK-8373866: Refactor java/net/httpclient/\n /ThrowingSubscribers*.java tests to use JUnit5\n + JDK-8373893: Refactor networking http server tests to use\n JUnit\n + JDK-8373913: Refactor serialization tests to use JUnit\n + JDK-8373928: 4 Dangling pointer defect groups in java.c\n + JDK-8374001: sun/security/ skip without Exceptions\n + JDK-8374058: Enhance JPEG handling\n + JDK-8374168: Resolve disabled warnings in JDWP agent\n + JDK-8374304: MultiResolutionSplashTest.java fails in CI:\n \"Image with wrong resolution is used for splash screen!\"\n + JDK-8374322: TestMemoryWithSubgroups.java fails Permission\n denied\n + JDK-8374343: Fix SIGSEGV when lib/modules is unreadable\n + JDK-8374449: Shenandoah: Leaf locks used by Shenandoah need\n lower ranks\n + JDK-8374506: Incorrect positioning of arrow icon in parent\n JMenu in Windows L\u0026F\n + JDK-8374712: AOTMappedHeapWriter::relocate_field_in_buffer\n should use CompressedOops::narrow_oop_cast\n + JDK-8374727: Audio configuration Platform class - use nio for\n getting endianness of the underlying platform\n + JDK-8374744: Enable dumping of APX EGPRs (R16--R31) in JVM\n fatal error logs\n + JDK-8374769: PPC: MASM::pop_cont_fastpath() should reset\n _cont_fastpath if SP == _cont_fastpath\n + JDK-8374888: Implement internal test cache to help\n UserIterCount test performance\n + JDK-8374998: Failing os::write - remove bad file\n + JDK-8375065: Update LCMS to 2.18\n + JDK-8375177: Gtest\n os_linux.decoder_get_source_info_valid_vm fails with\n -ffunction-sections\n + JDK-8375294: (fs) Files.copy can fail with EOPNOTSUPP when\n copy_file_range not supported\n + JDK-8376031: HttpsURLConnection.getServerCertificates() throws\n \"java.lang.IllegalStateException: connection not yet open\" for\n the HEAD method\n + JDK-8376104: C2 crashes in PhiNode::Ideal(PhaseGVN*, bool)\n accessing NULL pointer\n + JDK-8376151: Test javax/swing/JFileChooser/4966171/\n /bug4966171.java is failing with OOME\n + JDK-8376152: Test javax/sound/sampled/Clip/bug5070081.java\n timed out then completed\n + JDK-8376185: NoSuchFieldError thrown after a record with type\n annotation retransformed\n + JDK-8376233: Clean up code in Desktop native peer\n + JDK-8376287: Crashes when using -XX:ObjArrayMarkingStride=0\n + JDK-8376402: Dependencies::print_statistics() and\n AbstractClassHierarchyWalker::print_statistics() are not\n called from PRODUCT code\n + JDK-8376684: Compile OpenJDK in headless mode without required\n X11 libraries\n + JDK-8376956: Add JVMTI phase entering/setting to hserr event\n log\n + JDK-8376969: Shenandoah: GC state getters should be inlineable\n + JDK-8376970: Shenandoah: Verifier should do basic verification\n before touching oops\n + JDK-8377158: Enhance XBM image support\n + JDK-8377167: javax/imageio/ReadAbortTest.java throw NPE when\n x11 unavailable\n + JDK-8377498: Improve HttpServer handling\n + JDK-8377512: AOT cache creation fails with invalid native\n pointer\n + JDK-8377602: Create automated test for PageRange\n + JDK-8377727: Ghost caret and focus appear in non-editable\n text fields\n + JDK-8377833: Enhance Jar file processing\n + JDK-8377907: (process) Race in ProcessBuilder can cause JVM\n hangs\n + JDK-8377910: Minor cleanup of java/io/FileDescriptor/\n /Sharing.java\n + JDK-8377932: AOT cache is not rejected when JAR file has\n changed\n + JDK-8377944: LowMemoryTest2.java#id1 intermittent fails OOME:\n Metaspace\n + JDK-8377949: TestZRelocationSetEvent.java intermittent fails\n OOME\n + JDK-8378083: Mark shenandoah/generational/\n /TestOldGrowthTriggers.java as flagless\n + JDK-8378201: [OGL] glXMakeContextCurrent() drops the buffers\n of the unbound drawable\n + JDK-8378417: Printing All pages results in NPE for 1.1\n PrintJob\n + JDK-8378561: Mark gc/shenandoah/compiler/\n /TestLinkToNativeRBP.java as /native\n + JDK-8378687: Improve delegation of HttpURLConnection\n + JDK-8378727: [macOS] Missing dispatch_release for semaphores\n in CDesktopPeer\n + JDK-8378746: ZGC: jdk/jfr/event/gc/detailed/\n /TestZRelocationSetGroupEvent.java intermittent OOME\n + JDK-8378764: fileStream::fileSize() fails for \u003e2GB files on\n Windows\n + JDK-8378774: Bump update version for OpenJDK: jdk-25.0.4\n + JDK-8378810: Enable missing FFM test via jtreg requires for\n RISC-V\n + JDK-8378836: Enable linktime-gc by default on Linux ppc64le\n + JDK-8378878: Refactor java/nio/channels/\n /AsynchronousSocketChannel test to use JUnit\n + JDK-8378888: jdk/incubator/vector/\n /Float16OperationsBenchmark.java uses wrong package name\n + JDK-8379021: Shenandoah: Speedup ShenandoahSimpleBitMapTest\n + JDK-8379202: Support linktime-gc on Linux with clang\n + JDK-8379416: AIX build fails if system (not GNU) date tool is\n in PATH\n + JDK-8379425: Windows and macOS should not allow unsupported\n headless-only build\n + JDK-8379457: Test EATests.java#id0 ERROR: monitor list errors:\n error_cnt=1\n + JDK-8379464: Enable missing stack walking test via jtreg\n requires for RISC-V\n + JDK-8379499: [AIX] headless-only build of libjawt.so fails\n + JDK-8379515: draft-ietf-lamps-kyber-certificates is now\n RFC 9935\n + JDK-8380011: Path-to-gcroots search should not trigger stack\n overflows\n + JDK-8380041: PPC: remove POWER6 remnants\n + JDK-8380222: Refactor test/jdk/java/lang/Character TestNG\n tests to JUnit\n + JDK-8380316: Test runtime/os/AvailableProcessors.java fails\n Invalid argument\n + JDK-8380409: JVM crashes when -XX:AOTMode=create uses\n app.aotconf generated with JVMTI agent\n + JDK-8380428: ProblemList containers/docker/\n /TestJcmdWithSideCar.java on linux-all\n + JDK-8380431: Shenandoah: Concurrent modification of\n stack-chunk objects during evacuation\n + JDK-8380474: Crash SEGV in ThreadIdTable::lazy_initialize\n after JDK-8323792\n + JDK-8380565: PPC64: deoptimization stub should save vector\n registers\n + JDK-8380663: Update jcmd man page to include AOT.end_recording\n diagnostic command\n + JDK-8380672: Improve certification checking\n + JDK-8380846: GenShen: Remove the experimental option to\n disable adaptive tenuring\n + JDK-8380947: Add pull request template\n + JDK-8381039: Enhance AWT ImagingLib\n + JDK-8381049: Enhance Jar handling\n + JDK-8381205: GHA: Upgrade Node.js 20 to 24\n + JDK-8381315: compiler/vectorapi/TestVectorReallocation.java\n fails with -XX:UseAVX=1 after JDK-8380565\n + JDK-8381382: Shenandoah: assert(capacity \u003e 0) failed: free\n regions must have allocation capacity\n + JDK-8381519: Enhance Der Value Handling\n + JDK-8381796: Enhance Certificate parsing\n + JDK-8381871: GenShen: ShenandoahGCHeuristics flag not reset\n after ignoring non-adaptive value\n + JDK-8381935: Improve numChunks range in the PPC64 CallAranger\n + JDK-8381937: Make exceptions in\n Java_sun_security_mscapi_CKeyPairGenerator generateCKeyPair\n more specific\n + JDK-8382018: test/jdk/java/nio/file/spi/\n /SetDefaultProvider.java leaves a directory in /tmp\n + JDK-8382020: Time Zone Abbreviation Not Localized for\n Non-English Locales\n + JDK-8382035: [ubsan] Under UBSAN builds, disable tests that\n rely on simulated JVM crashes\n + JDK-8382090: Remove .rej and .orig from .gitignore\n + JDK-8382242: JFR: Metadata reconstruction invalidates\n ConstantMap for java.lang.String\n + JDK-8382295: Shenandoah: wrong denominator in full gc summary\n + JDK-8382395: Disable stringop-overflow in\n shenandoahGenerationalHeap.cpp\n + JDK-8382419: Add missed @key randomness after JDK-8370489\n + JDK-8382522: Disable stringop-overflow in\n safepointMechanism.cpp\n + JDK-8382740: JFR: Disable jdk.OldObjectSample event for\n generational ZGC\n + JDK-8382878: RISC-V: Missing InlineSkippedInstructionsCounter\n in ZGC barriers stubs\n + JDK-8382932: [25u] Test java/lang/instrument/\n /RetransformRecordTypeAnn/TestRetransformRecord.java\u200e fails\n with compilation error\n + JDK-8383161: [PPC64]\n MachCallDynamicJavaNode::ret_addr_offset() needs adaptation\n for COH\n + JDK-8383175: (tz) Update Timezone Data to 2026b\n + JDK-8383183: Shenandoah: Mangle trashed regions up to top\n instead of end\n + JDK-8383354: Update LCMS to 2.19.1\n + JDK-8383473: Follow on from tzdata2026b time change to\n include temporary hack BC time change\n + JDK-8383601: RISC-V:\n ShenandoahBarrierSetAssembler::load_reference_barrier calls\n \"weak\" on \"phantom\" path\n + JDK-8383630: Fix iteration in tests doing class redefinition\n + JDK-8384043: [REDO] Incorrect handling of Hawaii_Aleutian\n metazone\n + JDK-8384158: GHA: Downgrade Windows GHA runners to\n windows-2022 temporarily\n + JDK-8384163: (so) SocketChannel.connect and finishConnect()\n exception messages could be improved\n + JDK-8384223: RISC-V: entry_barrier_offset should consider\n UseZtso\n + JDK-8384486: NTLM tests fail on Windows 11 and Windows Server\n 2025\n + JDK-8384495: Update Libpng to 1.6.58\n + JDK-8384540: [25u, 21u, 17u] Update GHA JDKs after Apr/26\n updates\n + JDK-8384815: SelectOneKeyOutOfMany and PreferredKey fail after\n expired test certificate\n + JDK-8384902: Update GIFlib to 6.1.3\n + JDK-8385390: Update FreeType to 2.14.3\n + JDK-8385490: Update HarfBuzz to 14.2.0\n + JDK-8386551: Windows build broken because of MSys2/Make update\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Leap-16.0-1382",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21467-1.json"
},
{
"category": "self",
"summary": "SUSE Bug 1264994",
"url": "https://bugzilla.suse.com/1264994"
},
{
"category": "self",
"summary": "SUSE Bug 1272223",
"url": "https://bugzilla.suse.com/1272223"
},
{
"category": "self",
"summary": "SUSE Bug 1272224",
"url": "https://bugzilla.suse.com/1272224"
},
{
"category": "self",
"summary": "SUSE Bug 1272225",
"url": "https://bugzilla.suse.com/1272225"
},
{
"category": "self",
"summary": "SUSE Bug 1272227",
"url": "https://bugzilla.suse.com/1272227"
},
{
"category": "self",
"summary": "SUSE Bug 1272228",
"url": "https://bugzilla.suse.com/1272228"
},
{
"category": "self",
"summary": "SUSE Bug 1272235",
"url": "https://bugzilla.suse.com/1272235"
},
{
"category": "self",
"summary": "SUSE Bug 1272236",
"url": "https://bugzilla.suse.com/1272236"
},
{
"category": "self",
"summary": "SUSE Bug 1272237",
"url": "https://bugzilla.suse.com/1272237"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41254 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41254/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46917 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46917/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46968 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46968/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-47010 page",
"url": "https://www.suse.com/security/cve/CVE-2026-47010/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-47021 page",
"url": "https://www.suse.com/security/cve/CVE-2026-47021/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-47027 page",
"url": "https://www.suse.com/security/cve/CVE-2026-47027/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-47059 page",
"url": "https://www.suse.com/security/cve/CVE-2026-47059/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-47063 page",
"url": "https://www.suse.com/security/cve/CVE-2026-47063/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-60147 page",
"url": "https://www.suse.com/security/cve/CVE-2026-60147/"
}
],
"title": "Security update for java-25-openjdk",
"tracking": {
"current_release_date": "2026-09-17T17:40:26Z",
"generator": {
"date": "2026-07-28T16:12:30Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:21467-1",
"initial_release_date": "2026-07-28T16:12:30Z",
"revision_history": [
{
"date": "2026-07-28T16:12:30Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-07-28T16:12:30Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-09-16T20:43:32Z",
"number": "3",
"summary": "unknown changes"
},
{
"date": "2026-09-16T21:45:15Z",
"number": "4",
"summary": "unknown changes"
},
{
"date": "2026-09-17T17:40:26Z",
"number": "5",
"summary": "unknown changes"
}
],
"status": "final",
"version": "5"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"product": {
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"product_id": "java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk@25.0.4.0-160000.1.1?arch=aarch64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"product": {
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"product_id": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-demo@25.0.4.0-160000.1.1?arch=aarch64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"product": {
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"product_id": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-devel@25.0.4.0-160000.1.1?arch=aarch64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"product": {
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"product_id": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-headless@25.0.4.0-160000.1.1?arch=aarch64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"product": {
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"product_id": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-jmods@25.0.4.0-160000.1.1?arch=aarch64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"product": {
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"product_id": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-src@25.0.4.0-160000.1.1?arch=aarch64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"product": {
"name": "java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"product_id": "java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-javadoc@25.0.4.0-160000.1.1?arch=noarch\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"product": {
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"product_id": "java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk@25.0.4.0-160000.1.1?arch=ppc64le\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"product": {
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"product_id": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-demo@25.0.4.0-160000.1.1?arch=ppc64le\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"product": {
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"product_id": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-devel@25.0.4.0-160000.1.1?arch=ppc64le\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"product": {
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"product_id": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-headless@25.0.4.0-160000.1.1?arch=ppc64le\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"product": {
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"product_id": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-jmods@25.0.4.0-160000.1.1?arch=ppc64le\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"product": {
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"product_id": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-src@25.0.4.0-160000.1.1?arch=ppc64le\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"product": {
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"product_id": "java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk@25.0.4.0-160000.1.1?arch=s390x\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"product": {
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"product_id": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-demo@25.0.4.0-160000.1.1?arch=s390x\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"product": {
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"product_id": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-devel@25.0.4.0-160000.1.1?arch=s390x\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"product": {
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"product_id": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-headless@25.0.4.0-160000.1.1?arch=s390x\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"product": {
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"product_id": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-jmods@25.0.4.0-160000.1.1?arch=s390x\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"product": {
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"product_id": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-src@25.0.4.0-160000.1.1?arch=s390x\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"product": {
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"product_id": "java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk@25.0.4.0-160000.1.1?arch=x86_64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"product": {
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"product_id": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-demo@25.0.4.0-160000.1.1?arch=x86_64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"product": {
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"product_id": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-devel@25.0.4.0-160000.1.1?arch=x86_64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"product": {
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"product_id": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-headless@25.0.4.0-160000.1.1?arch=x86_64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"product": {
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"product_id": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-jmods@25.0.4.0-160000.1.1?arch=x86_64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64",
"product": {
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64",
"product_id": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-src@25.0.4.0-160000.1.1?arch=x86_64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 16.0",
"product": {
"name": "openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64"
},
"product_reference": "java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le"
},
"product_reference": "java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x"
},
"product_reference": "java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64"
},
"product_reference": "java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64"
},
"product_reference": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le"
},
"product_reference": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x"
},
"product_reference": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64"
},
"product_reference": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64"
},
"product_reference": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le"
},
"product_reference": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x"
},
"product_reference": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64"
},
"product_reference": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64"
},
"product_reference": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le"
},
"product_reference": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x"
},
"product_reference": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64"
},
"product_reference": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch"
},
"product_reference": "java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64"
},
"product_reference": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le"
},
"product_reference": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x"
},
"product_reference": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64"
},
"product_reference": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64"
},
"product_reference": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le"
},
"product_reference": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x"
},
"product_reference": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
},
"product_reference": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-41254",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41254"
}
],
"notes": [
{
"category": "general",
"text": "Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41254",
"url": "https://www.suse.com/security/cve/CVE-2026-41254"
},
{
"category": "external",
"summary": "SUSE Bug 1264994 for CVE-2026-41254",
"url": "https://bugzilla.suse.com/1264994"
},
{
"category": "external",
"summary": "SUSE Bug 1272458 for CVE-2026-41254",
"url": "https://bugzilla.suse.com/1272458"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.9,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T16:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-41254"
},
{
"cve": "CVE-2026-46917",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46917"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46917",
"url": "https://www.suse.com/security/cve/CVE-2026-46917"
},
{
"category": "external",
"summary": "SUSE Bug 1272223 for CVE-2026-46917",
"url": "https://bugzilla.suse.com/1272223"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T16:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-46917"
},
{
"cve": "CVE-2026-46968",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46968"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46968",
"url": "https://www.suse.com/security/cve/CVE-2026-46968"
},
{
"category": "external",
"summary": "SUSE Bug 1272224 for CVE-2026-46968",
"url": "https://bugzilla.suse.com/1272224"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T16:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-46968"
},
{
"cve": "CVE-2026-47010",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-47010"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-47010",
"url": "https://www.suse.com/security/cve/CVE-2026-47010"
},
{
"category": "external",
"summary": "SUSE Bug 1272225 for CVE-2026-47010",
"url": "https://bugzilla.suse.com/1272225"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T16:12:30Z",
"details": "low"
}
],
"title": "CVE-2026-47010"
},
{
"cve": "CVE-2026-47021",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-47021"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-47021",
"url": "https://www.suse.com/security/cve/CVE-2026-47021"
},
{
"category": "external",
"summary": "SUSE Bug 1272227 for CVE-2026-47021",
"url": "https://bugzilla.suse.com/1272227"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T16:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-47021"
},
{
"cve": "CVE-2026-47027",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-47027"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-47027",
"url": "https://www.suse.com/security/cve/CVE-2026-47027"
},
{
"category": "external",
"summary": "SUSE Bug 1272228 for CVE-2026-47027",
"url": "https://bugzilla.suse.com/1272228"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T16:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-47027"
},
{
"cve": "CVE-2026-47059",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-47059"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-47059",
"url": "https://www.suse.com/security/cve/CVE-2026-47059"
},
{
"category": "external",
"summary": "SUSE Bug 1272235 for CVE-2026-47059",
"url": "https://bugzilla.suse.com/1272235"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T16:12:30Z",
"details": "low"
}
],
"title": "CVE-2026-47059"
},
{
"cve": "CVE-2026-47063",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-47063"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-47063",
"url": "https://www.suse.com/security/cve/CVE-2026-47063"
},
{
"category": "external",
"summary": "SUSE Bug 1272236 for CVE-2026-47063",
"url": "https://bugzilla.suse.com/1272236"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T16:12:30Z",
"details": "important"
}
],
"title": "CVE-2026-47063"
},
{
"cve": "CVE-2026-60147",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-60147"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-60147",
"url": "https://www.suse.com/security/cve/CVE-2026-60147"
},
{
"category": "external",
"summary": "SUSE Bug 1272237 for CVE-2026-60147",
"url": "https://bugzilla.suse.com/1272237"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T16:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-60147"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…