OPENSUSE-SU-2026:21467-1
Vulnerability from csaf_opensuse - Published: 2026-07-28 16:12 - Updated: 2026-09-17 17:40Summary
Security update for java-25-openjdk
Severity
Important
Notes
Title of the patch: Security update for java-25-openjdk
Description of the patch: This update for java-25-openjdk fixes the following issues:
- CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize (bsc#1264994).
- CVE-2026-46917: partial denial of service via TLS (bsc#1272223).
- CVE-2026-46968: unauthorized creation, deletion or modification access to critical data (bsc#1272224).
- CVE-2026-47010: unauthorized update, insert or delete access (bsc#1272225).
- CVE-2026-47021: partial denial of service via multiple network protocols (bsc#1272227).
- CVE-2026-47027: partial denial of service via multiple network protocols (bsc#1272228).
- CVE-2026-47059: partial denial of service via multiple network protocols (bsc#1272235).
- CVE-2026-47063: unauthorized creation, deletion or modification access to critical data (bsc#1272236).
- CVE-2026-60147: unauthorized update, insert or delete access (bsc#1272237).
Changes for java-25-openjdk:
- Update to upstream tag jdk-25.0.4+7 (July 2026 CPU):
+ JDK-7184899: Test sun/java2d/X11SurfaceData/
/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail
+ JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes
fails
+ JDK-8064922: [macos] Test javax/swing/JTabbedPane/4624207/
/bug4624207.java fails
+ JDK-8068293: [TEST_BUG] Test closed/com/sun/java/swing/plaf/
/motif/InternalFrame/4150591/bug4150591.java fails with
GTKLookAndFeel
+ JDK-8068310: [TEST_BUG] Test javax/swing/JColorChooser/
/Test4234761.java fails with GTKL&F
+ JDK-8144124: [macosx] The tabs can't be aligned when we
pressing the key of 'R','B','L','C' or 'T'.
+ JDK-8203004: UnixMultiResolutionSplashTest.java fails on
Ubuntu16.04
+ JDK-8213530: Test java/awt/Modal/ToFront/
/DialogToFrontModeless1Test.java fails on Linux
+ JDK-8221451: PIT: sun/java2d/X11SurfaceData/
/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fails
+ JDK-8225787: java/awt/Window/GetScreenLocation/
/GetScreenLocationTest.java fails on Ubuntu
+ JDK-8241066: Shenandoah: fix or cleanup SH::do_full_collection
+ JDK-8261743: Shenandoah: enable String deduplication with
compact heuristics
+ JDK-8264851: Shenandoah: Rework control loop mechanics to use
timed waits
+ JDK-8278102: containers/docker/TestJcmd.java failed with
"RuntimeException: Could not find specified process"
+ JDK-8279196: Test: jdk/jfr/event/gc/stacktrace/
/TestG1OldAllocationPendingStackTrace.java timed out
+ JDK-8297191: [macos] Printing a page range with starting
page > 1 results in missing pages
+ JDK-8298823: [macos] java/awt/Mouse/EnterExitEvents/
/DragWindowTest.java continues to fail with "No MouseReleased
event on label!"
+ JDK-8319326: GC: Make TestParallelRefProc use
createTestJavaProcessBuilder
+ JDK-8319540: GC: Make TestSelectDefaultGC use
+ JDK-8321303: Intermittent open/test/jdk/java/awt/
/KeyboardFocusmanager/ConsumeNextMnemonicKeyTypedTest/
/ConsumeNextMnemonicKeyTypedTest.java failure on Linux
+ JDK-8321687: Test vmTestbase/nsk/jvmti/scenarios/contention/
/TC03/tc03t002/TestDescription.java failed:
JVMTI_ERROR_THREAD_NOT_ALIVE
+ JDK-8323792: ThreadSnapshot::initialize can cause assert in
Thread::check_for_dangling_thread_pointer (possibility of
dangling Thread pointer)
+ JDK-8325482: Test that distinct seeds produce distinct traces
for compiler stress flags
+ JDK-8335355: Shenandoah: Fix race condition in gc/shenandoah/
/mxbeans/TestPauseNotifications.java
+ JDK-8339526: C2: store incorrectly removed for clone()
transformed to series of loads/stores
+ JDK-8340182: Java HttpClient does not follow default retry
limit of 3 retries
+ JDK-8341735: Rewrite the build/AbsPathsInImage.java test to
not load the entire file at once
+ JDK-8344345: test/hotspot/gtest/x86/x86-asmtest.py has
trailing whitespaces
+ JDK-8345631: TestRegionSamplingLogging.java
#generational-rotation intermittent fails
+ JDK-8347167: Reduce allocation in
com.sun.net.httpserver.Headers::normalize
+ JDK-8347938: Add Support for the Latest ML-KEM and ML-DSA
Private Key Encodings
+ JDK-8351010: Test java/io/File/GetXSpace.java failed: / usable
space 56380809216 > free space 14912244940
+ JDK-8352914: Shenandoah: Change definition of
ShenandoahSharedValue to int32_t to leverage platform atomics
+ JDK-8353115: GenShen: mixed evacuation candidate regions need
accurate live_data
+ JDK-8354650: [PPC64] Try to reduce register definitions
+ JDK-8355339: Test java/io/File/GetCanonicalPath.java failed:
The specified network name is no longer available
+ JDK-8357086: os::xxx functions returning memory size should
return size_t
+ JDK-8358600: Template-Framework Library: Template for
TestFramework test class
+ JDK-8358772: Template-Framework Library: Primitive Types
+ JDK-8359083: Test jdkCheckHtml.java should report
SkippedException rather than report fails when miss tidy
+ JDK-8359223: HttpClient: Remove leftovers from the
SecurityManager cleanup
+ JDK-8359412: Template-Framework Library: Operations and
Expressions
+ JDK-8359433: The final modifier on Windows L&F internal UI
classes prevents extending them in apps
+ JDK-8361339: Test gc/shenandoah/TestLargeObjectAlignment.java
#generational fails on macOS aarch64 with OOM: Java heap space
+ JDK-8361606: ConsumeNextMnemonicKeyTypedTest.java fails on
Windows: character typed with VK_A: a
+ JDK-8361699: C2: assert(can_reduce_phi(n->as_Phi())) failed:
Sanity: previous reducible Phi is no longer reducible before
SUT
+ JDK-8361726: Shenandoah: More detailed evacuation
instrumentation
+ JDK-8362428: Update IANA Language Subtag Registry to Version
2025-08-25
+ JDK-8363943: ARM32: Represent Registers as values
+ JDK-8363949: Incorrect jtreg header in
MonitorWithDeadObjectTest.java
+ JDK-8363986: Heap region in CDS archive is not at
deterministic address
+ JDK-8364315: Remove unused xml files from test/jaxp/javax/xml/
/jaxp/functional/javax/xml/transform/xmlfiles
+ JDK-8364657: Crash for SecureRandom.generateSeed(0) on Windows
x86-64
+ JDK-8364927: Add @requires annotation to
TestReclaimStringsLeaksMemory.java
+ JDK-8365057: Add support for java.util.concurrent lock
information to Thread.dump_to_file
+ JDK-8365379: SU3.applyInsets may produce wrong results
+ JDK-8365423: [macos26] java/awt/MenuBar/8007006/
/bug8007006.java fails on macOS 26
+ JDK-8365424: [macos26] java/awt/Frame/DisposeTest.java fails
on macOS 26
+ JDK-8365623: test/jdk/sun/security/pkcs11/tls/ tests skipped
without skip exception
+ JDK-8365625: Can't change accelerator colors in Windows L&F
+ JDK-8365792: GenShen: assertion "Generations aren't
reconciled"
+ JDK-8366692: Several gc/shenandoah tests timed out
+ JDK-8366695: Test sun/jvmstat/monitor/MonitoredVm/
/MonitorVmStartTerminate.java timed out
+ JDK-8366852: java/awt/Choice/ChoiceMouseWheelTest/
/ChoiceMouseWheelTest.java test is failing
+ JDK-8367096: jdk/open/test/jdk/sun/security/pkcs11/ rsa, ec,
config, secmod and sslecc tests are skipping but showing as
pass
+ JDK-8367450: Shenandoah: Log the composition of the collection
set
+ JDK-8367451: GenShen: Remove the option to compute age census
during evacuation
+ JDK-8367473: Shenandoah: Make the detailed evacuation metrics
a runtime diagnostic option
+ JDK-8367485: os::physical_memory is broken in 32-bit JVMs when
running on 64-bit OSes
+ JDK-8367531: Template Framework: use scopes and tokens instead
of misbehaving immediate-return-queries
+ JDK-8367646: [GenShen] Control thread may overwrite gc
cancellation cause set by mutator
+ JDK-8367708: GenShen: Reduce total evacuation burden
+ JDK-8367709: GenShen: Dirty cards for objects that get
promoted by safepoint that intervenes between allocation and
stores
+ JDK-8367722: [GenShen] ShenandoahEvacuationStats is always
empty
+ JDK-8367949: JFR: MethodTrace double-counts methods that catch
their own exceptions
+ JDK-8368001: java/text/Format/NumberFormat/
/NumberRoundTrip.java timed out
+ JDK-8368015: Shenandoah: fix error in computation of average
allocation rate
+ JDK-8368041: Enhance TLS certificate handling
+ JDK-8368159: Significant performance overhead when started
with jdwp agent and unattached debugger
+ JDK-8368181: ProblemList java/awt/Dialog/ModalExcludedTest/
/ModalExcludedTest.java
+ JDK-8368307: Shenandoah: get_next_bit_impl should special case
weak and strong mark bits
+ JDK-8368499: GenShen: Do not collect age census during evac
when adaptive tenuring is disabled
+ JDK-8368501: Shenandoah: GC progress evaluation does not use
generation
+ JDK-8368524: Tests are skipped and shown as passed in test/
/jdk/sun/security/pkcs11/Cipher/KeyWrap
+ JDK-8368681: Shenandoah: Add documentation comments for
ShenandoahAllocationRate
+ JDK-8369128: ProblemList jdk/jfr/event/profiling/
/TestCPUTimeSampleQueueAutoSizes.java in Xcomp configs
+ JDK-8369132: Disable vmTestbase/gc/vector/CircularListLow and
LinearListLow with SerialGC
+ JDK-8369133: Disable gc/g1/TestShrinkAuxiliaryDataRunner.java
with UseLargePages option
+ JDK-8369251: Opensource few tests
+ JDK-8369561: sun/java2d/OpenGL/DrawBitmaskImage.java#id0:
Incorrect color for first pixel (actual=ff000000)
+ JDK-8369683: Exclude runtime/Monitor/
/MonitorWithDeadObjectTest.java#DumpThreadsBeforeDetach on
Alpine Linux debug
+ JDK-8369736: Add management interface for AOT cache creation
+ JDK-8369817: [TESTBUG] EmptyPath::toString is ignored
+ JDK-8369912: [TESTBUG] testlibrary_tests/template_framework/
/examples/TestExpressions.java fails with ArithmeticException:
/ by zero - forgot to respect Expression.info
+ JDK-8369950: TLS connection to IPv6 address fails with BCJSSE
due to IllegalArgumentException
+ JDK-8370370: Add still more cases to WorstCaseTests
+ JDK-8370489: Some compiler tests miss the @key randomness
+ JDK-8370502: C2: segfault while adding node to IGVN worklist
+ JDK-8370521: GenShen: Various code cleanup related to
promotion
+ JDK-8370939: C2: SIGSEGV in SafePointNode::verify_input when
processing MH call from
Compile::process_late_inline_calls_no_inline()
+ JDK-8371284: GenShen: Avoid unnecessary card marking
+ JDK-8371381: [Shenandoah] Setting ergo flags should use
FLAG_SET_ERGO
+ JDK-8371503: RETAIN_IMAGE_AFTER_TEST do not work for some
tests
+ JDK-8371792: Refactor barrier loop tests out of TestIfMinMax
+ JDK-8371893: [macOS] use dead_strip linker option to reduce
binary size
+ JDK-8372272: Hotspot shared lib loading - add load attempts to
Events::log
+ JDK-8372351: Add 2 WISeKey roots
+ JDK-8372380: Make hs_err reporting more robust for unattached
threads
+ JDK-8372513: Shenandoah: ShenandoahMaxRegionSize can produce
an unaligned heap alignment
+ JDK-8372851: Modify java/io/File/GetXSpace.java to print path
on failure of native call
+ JDK-8372861: Genshen: Override parallel_region_stride of
ShenandoahResetBitmapClosure to a reasonable value for better
parallelism
+ JDK-8373039: Remove Incorrect Asserts in
shenandoahScanRemembered
+ JDK-8373120: Virtual thread stuck in BLOCKED state
+ JDK-8373239: Test java/awt/print/PrinterJob/PageRanges.java
fails with incorrect selection of printed pages
+ JDK-8373275: Improve DTLS handshaking
+ JDK-8373515: Migrate "test/jdk/java/net/httpclient/" to
null-safe "SimpleSSLContext" methods
+ JDK-8373579: Problem list compiler/runtime/Test7196199.java
+ JDK-8373650: Test "javax/swing/JMenuItem/6458123/
/ManualBug6458123.java" fails because the check icons are not
aligned properly as expected
+ JDK-8373676: Test javax/net/ssl/HttpsURLConnection/
/SubjectAltNameIP.java fails on a machine without IPV6
+ JDK-8373690: Unexpected Keystore message using
jdk.crypto.disabledAlgorithms
+ JDK-8373714: Shenandoah: Register heuristic penalties
following a degenerated GC
+ JDK-8373718: jdk/internal/misc/VM/RuntimeArguments.java test
fails in Virtual threads mode
+ JDK-8373796: Refactor java/net/httpclient/
/ThrowingPublishers*.java tests to use JUnit5
+ JDK-8373847: Test javax/swing/JMenuItem/MenuItemTest/
/bug6197830.java failed because The test case automatically
fails when clicking any items in the "Nothing" menu in all
four windows (Left-to-right)-Menu Item Test and
(Right-to-left)-Menu Item Test
+ JDK-8373866: Refactor java/net/httpclient/
/ThrowingSubscribers*.java tests to use JUnit5
+ JDK-8373893: Refactor networking http server tests to use
JUnit
+ JDK-8373913: Refactor serialization tests to use JUnit
+ JDK-8373928: 4 Dangling pointer defect groups in java.c
+ JDK-8374001: sun/security/ skip without Exceptions
+ JDK-8374058: Enhance JPEG handling
+ JDK-8374168: Resolve disabled warnings in JDWP agent
+ JDK-8374304: MultiResolutionSplashTest.java fails in CI:
"Image with wrong resolution is used for splash screen!"
+ JDK-8374322: TestMemoryWithSubgroups.java fails Permission
denied
+ JDK-8374343: Fix SIGSEGV when lib/modules is unreadable
+ JDK-8374449: Shenandoah: Leaf locks used by Shenandoah need
lower ranks
+ JDK-8374506: Incorrect positioning of arrow icon in parent
JMenu in Windows L&F
+ JDK-8374712: AOTMappedHeapWriter::relocate_field_in_buffer
should use CompressedOops::narrow_oop_cast
+ JDK-8374727: Audio configuration Platform class - use nio for
getting endianness of the underlying platform
+ JDK-8374744: Enable dumping of APX EGPRs (R16--R31) in JVM
fatal error logs
+ JDK-8374769: PPC: MASM::pop_cont_fastpath() should reset
_cont_fastpath if SP == _cont_fastpath
+ JDK-8374888: Implement internal test cache to help
UserIterCount test performance
+ JDK-8374998: Failing os::write - remove bad file
+ JDK-8375065: Update LCMS to 2.18
+ JDK-8375177: Gtest
os_linux.decoder_get_source_info_valid_vm fails with
-ffunction-sections
+ JDK-8375294: (fs) Files.copy can fail with EOPNOTSUPP when
copy_file_range not supported
+ JDK-8376031: HttpsURLConnection.getServerCertificates() throws
"java.lang.IllegalStateException: connection not yet open" for
the HEAD method
+ JDK-8376104: C2 crashes in PhiNode::Ideal(PhaseGVN*, bool)
accessing NULL pointer
+ JDK-8376151: Test javax/swing/JFileChooser/4966171/
/bug4966171.java is failing with OOME
+ JDK-8376152: Test javax/sound/sampled/Clip/bug5070081.java
timed out then completed
+ JDK-8376185: NoSuchFieldError thrown after a record with type
annotation retransformed
+ JDK-8376233: Clean up code in Desktop native peer
+ JDK-8376287: Crashes when using -XX:ObjArrayMarkingStride=0
+ JDK-8376402: Dependencies::print_statistics() and
AbstractClassHierarchyWalker::print_statistics() are not
called from PRODUCT code
+ JDK-8376684: Compile OpenJDK in headless mode without required
X11 libraries
+ JDK-8376956: Add JVMTI phase entering/setting to hserr event
log
+ JDK-8376969: Shenandoah: GC state getters should be inlineable
+ JDK-8376970: Shenandoah: Verifier should do basic verification
before touching oops
+ JDK-8377158: Enhance XBM image support
+ JDK-8377167: javax/imageio/ReadAbortTest.java throw NPE when
x11 unavailable
+ JDK-8377498: Improve HttpServer handling
+ JDK-8377512: AOT cache creation fails with invalid native
pointer
+ JDK-8377602: Create automated test for PageRange
+ JDK-8377727: Ghost caret and focus appear in non-editable
text fields
+ JDK-8377833: Enhance Jar file processing
+ JDK-8377907: (process) Race in ProcessBuilder can cause JVM
hangs
+ JDK-8377910: Minor cleanup of java/io/FileDescriptor/
/Sharing.java
+ JDK-8377932: AOT cache is not rejected when JAR file has
changed
+ JDK-8377944: LowMemoryTest2.java#id1 intermittent fails OOME:
Metaspace
+ JDK-8377949: TestZRelocationSetEvent.java intermittent fails
OOME
+ JDK-8378083: Mark shenandoah/generational/
/TestOldGrowthTriggers.java as flagless
+ JDK-8378201: [OGL] glXMakeContextCurrent() drops the buffers
of the unbound drawable
+ JDK-8378417: Printing All pages results in NPE for 1.1
PrintJob
+ JDK-8378561: Mark gc/shenandoah/compiler/
/TestLinkToNativeRBP.java as /native
+ JDK-8378687: Improve delegation of HttpURLConnection
+ JDK-8378727: [macOS] Missing dispatch_release for semaphores
in CDesktopPeer
+ JDK-8378746: ZGC: jdk/jfr/event/gc/detailed/
/TestZRelocationSetGroupEvent.java intermittent OOME
+ JDK-8378764: fileStream::fileSize() fails for >2GB files on
Windows
+ JDK-8378774: Bump update version for OpenJDK: jdk-25.0.4
+ JDK-8378810: Enable missing FFM test via jtreg requires for
RISC-V
+ JDK-8378836: Enable linktime-gc by default on Linux ppc64le
+ JDK-8378878: Refactor java/nio/channels/
/AsynchronousSocketChannel test to use JUnit
+ JDK-8378888: jdk/incubator/vector/
/Float16OperationsBenchmark.java uses wrong package name
+ JDK-8379021: Shenandoah: Speedup ShenandoahSimpleBitMapTest
+ JDK-8379202: Support linktime-gc on Linux with clang
+ JDK-8379416: AIX build fails if system (not GNU) date tool is
in PATH
+ JDK-8379425: Windows and macOS should not allow unsupported
headless-only build
+ JDK-8379457: Test EATests.java#id0 ERROR: monitor list errors:
error_cnt=1
+ JDK-8379464: Enable missing stack walking test via jtreg
requires for RISC-V
+ JDK-8379499: [AIX] headless-only build of libjawt.so fails
+ JDK-8379515: draft-ietf-lamps-kyber-certificates is now
RFC 9935
+ JDK-8380011: Path-to-gcroots search should not trigger stack
overflows
+ JDK-8380041: PPC: remove POWER6 remnants
+ JDK-8380222: Refactor test/jdk/java/lang/Character TestNG
tests to JUnit
+ JDK-8380316: Test runtime/os/AvailableProcessors.java fails
Invalid argument
+ JDK-8380409: JVM crashes when -XX:AOTMode=create uses
app.aotconf generated with JVMTI agent
+ JDK-8380428: ProblemList containers/docker/
/TestJcmdWithSideCar.java on linux-all
+ JDK-8380431: Shenandoah: Concurrent modification of
stack-chunk objects during evacuation
+ JDK-8380474: Crash SEGV in ThreadIdTable::lazy_initialize
after JDK-8323792
+ JDK-8380565: PPC64: deoptimization stub should save vector
registers
+ JDK-8380663: Update jcmd man page to include AOT.end_recording
diagnostic command
+ JDK-8380672: Improve certification checking
+ JDK-8380846: GenShen: Remove the experimental option to
disable adaptive tenuring
+ JDK-8380947: Add pull request template
+ JDK-8381039: Enhance AWT ImagingLib
+ JDK-8381049: Enhance Jar handling
+ JDK-8381205: GHA: Upgrade Node.js 20 to 24
+ JDK-8381315: compiler/vectorapi/TestVectorReallocation.java
fails with -XX:UseAVX=1 after JDK-8380565
+ JDK-8381382: Shenandoah: assert(capacity > 0) failed: free
regions must have allocation capacity
+ JDK-8381519: Enhance Der Value Handling
+ JDK-8381796: Enhance Certificate parsing
+ JDK-8381871: GenShen: ShenandoahGCHeuristics flag not reset
after ignoring non-adaptive value
+ JDK-8381935: Improve numChunks range in the PPC64 CallAranger
+ JDK-8381937: Make exceptions in
Java_sun_security_mscapi_CKeyPairGenerator generateCKeyPair
more specific
+ JDK-8382018: test/jdk/java/nio/file/spi/
/SetDefaultProvider.java leaves a directory in /tmp
+ JDK-8382020: Time Zone Abbreviation Not Localized for
Non-English Locales
+ JDK-8382035: [ubsan] Under UBSAN builds, disable tests that
rely on simulated JVM crashes
+ JDK-8382090: Remove .rej and .orig from .gitignore
+ JDK-8382242: JFR: Metadata reconstruction invalidates
ConstantMap for java.lang.String
+ JDK-8382295: Shenandoah: wrong denominator in full gc summary
+ JDK-8382395: Disable stringop-overflow in
shenandoahGenerationalHeap.cpp
+ JDK-8382419: Add missed @key randomness after JDK-8370489
+ JDK-8382522: Disable stringop-overflow in
safepointMechanism.cpp
+ JDK-8382740: JFR: Disable jdk.OldObjectSample event for
generational ZGC
+ JDK-8382878: RISC-V: Missing InlineSkippedInstructionsCounter
in ZGC barriers stubs
+ JDK-8382932: [25u] Test java/lang/instrument/
/RetransformRecordTypeAnn/TestRetransformRecord.java fails
with compilation error
+ JDK-8383161: [PPC64]
MachCallDynamicJavaNode::ret_addr_offset() needs adaptation
for COH
+ JDK-8383175: (tz) Update Timezone Data to 2026b
+ JDK-8383183: Shenandoah: Mangle trashed regions up to top
instead of end
+ JDK-8383354: Update LCMS to 2.19.1
+ JDK-8383473: Follow on from tzdata2026b time change to
include temporary hack BC time change
+ JDK-8383601: RISC-V:
ShenandoahBarrierSetAssembler::load_reference_barrier calls
"weak" on "phantom" path
+ JDK-8383630: Fix iteration in tests doing class redefinition
+ JDK-8384043: [REDO] Incorrect handling of Hawaii_Aleutian
metazone
+ JDK-8384158: GHA: Downgrade Windows GHA runners to
windows-2022 temporarily
+ JDK-8384163: (so) SocketChannel.connect and finishConnect()
exception messages could be improved
+ JDK-8384223: RISC-V: entry_barrier_offset should consider
UseZtso
+ JDK-8384486: NTLM tests fail on Windows 11 and Windows Server
2025
+ JDK-8384495: Update Libpng to 1.6.58
+ JDK-8384540: [25u, 21u, 17u] Update GHA JDKs after Apr/26
updates
+ JDK-8384815: SelectOneKeyOutOfMany and PreferredKey fail after
expired test certificate
+ JDK-8384902: Update GIFlib to 6.1.3
+ JDK-8385390: Update FreeType to 2.14.3
+ JDK-8385490: Update HarfBuzz to 14.2.0
+ JDK-8386551: Windows build broken because of MSys2/Make update
Patchnames: openSUSE-Leap-16.0-1382
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
25 products, the same list as for
CVE-2026-41254
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
25 products, the same list as for
CVE-2026-41254
Threats
Impact
moderate
Affected products
Recommended
25 products, the same list as for
CVE-2026-41254
Threats
Impact
low
5.3 (Medium)
Affected products
Recommended
25 products, the same list as for
CVE-2026-41254
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
25 products, the same list as for
CVE-2026-41254
Threats
Impact
moderate
Affected products
Recommended
25 products, the same list as for
CVE-2026-41254
Threats
Impact
low
7.5 (High)
Affected products
Recommended
25 products, the same list as for
CVE-2026-41254
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
25 products, the same list as for
CVE-2026-41254
Threats
Impact
moderate
References
39 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for java-25-openjdk",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for java-25-openjdk fixes the following issues:\n\n- CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize (bsc#1264994).\n- CVE-2026-46917: partial denial of service via TLS (bsc#1272223).\n- CVE-2026-46968: unauthorized creation, deletion or modification access to critical data (bsc#1272224).\n- CVE-2026-47010: unauthorized update, insert or delete access (bsc#1272225).\n- CVE-2026-47021: partial denial of service via multiple network protocols (bsc#1272227).\n- CVE-2026-47027: partial denial of service via multiple network protocols (bsc#1272228).\n- CVE-2026-47059: partial denial of service via multiple network protocols (bsc#1272235).\n- CVE-2026-47063: unauthorized creation, deletion or modification access to critical data (bsc#1272236).\n- CVE-2026-60147: unauthorized update, insert or delete access (bsc#1272237).\n\nChanges for java-25-openjdk:\n\n- Update to upstream tag jdk-25.0.4+7 (July 2026 CPU):\n\n + JDK-7184899: Test sun/java2d/X11SurfaceData/\n /SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail\n + JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes\n fails\n + JDK-8064922: [macos] Test javax/swing/JTabbedPane/4624207/\n /bug4624207.java fails\n + JDK-8068293: [TEST_BUG] Test closed/com/sun/java/swing/plaf/\n /motif/InternalFrame/4150591/bug4150591.java fails with\n GTKLookAndFeel\n + JDK-8068310: [TEST_BUG] Test javax/swing/JColorChooser/\n /Test4234761.java fails with GTKL\u0026F\n + JDK-8144124: [macosx] The tabs can\u0027t be aligned when we\n pressing the key of \u0027R\u0027,\u0027B\u0027,\u0027L\u0027,\u0027C\u0027 or \u0027T\u0027.\n + JDK-8203004: UnixMultiResolutionSplashTest.java fails on\n Ubuntu16.04\n + JDK-8213530: Test java/awt/Modal/ToFront/\n /DialogToFrontModeless1Test.java fails on Linux\n + JDK-8221451: PIT: sun/java2d/X11SurfaceData/\n /SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fails\n + JDK-8225787: java/awt/Window/GetScreenLocation/\n /GetScreenLocationTest.java fails on Ubuntu\n + JDK-8241066: Shenandoah: fix or cleanup SH::do_full_collection\n + JDK-8261743: Shenandoah: enable String deduplication with\n compact heuristics\n + JDK-8264851: Shenandoah: Rework control loop mechanics to use\n timed waits\n + JDK-8278102: containers/docker/TestJcmd.java failed with\n \"RuntimeException: Could not find specified process\"\n + JDK-8279196: Test: jdk/jfr/event/gc/stacktrace/\n /TestG1OldAllocationPendingStackTrace.java timed out\n + JDK-8297191: [macos] Printing a page range with starting\n page \u003e 1 results in missing pages\n + JDK-8298823: [macos] java/awt/Mouse/EnterExitEvents/\n /DragWindowTest.java continues to fail with \"No MouseReleased\n event on label!\"\n + JDK-8319326: GC: Make TestParallelRefProc use\n createTestJavaProcessBuilder\n + JDK-8319540: GC: Make TestSelectDefaultGC use\n + JDK-8321303: Intermittent open/test/jdk/java/awt/\n /KeyboardFocusmanager/ConsumeNextMnemonicKeyTypedTest/\n /ConsumeNextMnemonicKeyTypedTest.java failure on Linux\n + JDK-8321687: Test vmTestbase/nsk/jvmti/scenarios/contention/\n /TC03/tc03t002/TestDescription.java failed:\n JVMTI_ERROR_THREAD_NOT_ALIVE\n + JDK-8323792: ThreadSnapshot::initialize can cause assert in\n Thread::check_for_dangling_thread_pointer (possibility of\n dangling Thread pointer)\n + JDK-8325482: Test that distinct seeds produce distinct traces\n for compiler stress flags\n + JDK-8335355: Shenandoah: Fix race condition in gc/shenandoah/\n /mxbeans/TestPauseNotifications.java\n + JDK-8339526: C2: store incorrectly removed for clone()\n transformed to series of loads/stores\n + JDK-8340182: Java HttpClient does not follow default retry\n limit of 3 retries\n + JDK-8341735: Rewrite the build/AbsPathsInImage.java test to\n not load the entire file at once\n + JDK-8344345: test/hotspot/gtest/x86/x86-asmtest.py has\n trailing whitespaces\n + JDK-8345631: TestRegionSamplingLogging.java\n #generational-rotation intermittent fails\n + JDK-8347167: Reduce allocation in\n com.sun.net.httpserver.Headers::normalize\n + JDK-8347938: Add Support for the Latest ML-KEM and ML-DSA\n Private Key Encodings\n + JDK-8351010: Test java/io/File/GetXSpace.java failed: / usable\n space 56380809216 \u003e free space 14912244940\n + JDK-8352914: Shenandoah: Change definition of\n ShenandoahSharedValue to int32_t to leverage platform atomics\n + JDK-8353115: GenShen: mixed evacuation candidate regions need\n accurate live_data\n + JDK-8354650: [PPC64] Try to reduce register definitions\n + JDK-8355339: Test java/io/File/GetCanonicalPath.java failed:\n The specified network name is no longer available\n + JDK-8357086: os::xxx functions returning memory size should\n return size_t\n + JDK-8358600: Template-Framework Library: Template for\n TestFramework test class\n + JDK-8358772: Template-Framework Library: Primitive Types\n + JDK-8359083: Test jdkCheckHtml.java should report\n SkippedException rather than report fails when miss tidy\n + JDK-8359223: HttpClient: Remove leftovers from the\n SecurityManager cleanup\n + JDK-8359412: Template-Framework Library: Operations and\n Expressions\n + JDK-8359433: The final modifier on Windows L\u0026F internal UI\n classes prevents extending them in apps\n + JDK-8361339: Test gc/shenandoah/TestLargeObjectAlignment.java\n #generational fails on macOS aarch64 with OOM: Java heap space\n + JDK-8361606: ConsumeNextMnemonicKeyTypedTest.java fails on\n Windows: character typed with VK_A: a\n + JDK-8361699: C2: assert(can_reduce_phi(n-\u003eas_Phi())) failed:\n Sanity: previous reducible Phi is no longer reducible before\n SUT\n + JDK-8361726: Shenandoah: More detailed evacuation\n instrumentation\n + JDK-8362428: Update IANA Language Subtag Registry to Version\n 2025-08-25\n + JDK-8363943: ARM32: Represent Registers as values\n + JDK-8363949: Incorrect jtreg header in\n MonitorWithDeadObjectTest.java\n + JDK-8363986: Heap region in CDS archive is not at\n deterministic address\n + JDK-8364315: Remove unused xml files from test/jaxp/javax/xml/\n /jaxp/functional/javax/xml/transform/xmlfiles\n + JDK-8364657: Crash for SecureRandom.generateSeed(0) on Windows\n x86-64\n + JDK-8364927: Add @requires annotation to\n TestReclaimStringsLeaksMemory.java\n + JDK-8365057: Add support for java.util.concurrent lock\n information to Thread.dump_to_file\n + JDK-8365379: SU3.applyInsets may produce wrong results\n + JDK-8365423: [macos26] java/awt/MenuBar/8007006/\n /bug8007006.java fails on macOS 26\n + JDK-8365424: [macos26] java/awt/Frame/DisposeTest.java fails\n on macOS 26\n + JDK-8365623: test/jdk/sun/security/pkcs11/tls/ tests skipped\n without skip exception\n + JDK-8365625: Can\u0027t change accelerator colors in Windows L\u0026F\n + JDK-8365792: GenShen: assertion \"Generations aren\u0027t\n reconciled\"\n + JDK-8366692: Several gc/shenandoah tests timed out\n + JDK-8366695: Test sun/jvmstat/monitor/MonitoredVm/\n /MonitorVmStartTerminate.java timed out\n + JDK-8366852: java/awt/Choice/ChoiceMouseWheelTest/\n /ChoiceMouseWheelTest.java test is failing\n + JDK-8367096: jdk/open/test/jdk/sun/security/pkcs11/ rsa, ec,\n config, secmod and sslecc tests are skipping but showing as\n pass\n + JDK-8367450: Shenandoah: Log the composition of the collection\n set\n + JDK-8367451: GenShen: Remove the option to compute age census\n during evacuation\n + JDK-8367473: Shenandoah: Make the detailed evacuation metrics\n a runtime diagnostic option\n + JDK-8367485: os::physical_memory is broken in 32-bit JVMs when\n running on 64-bit OSes\n + JDK-8367531: Template Framework: use scopes and tokens instead\n of misbehaving immediate-return-queries\n + JDK-8367646: [GenShen] Control thread may overwrite gc\n cancellation cause set by mutator\n + JDK-8367708: GenShen: Reduce total evacuation burden\n + JDK-8367709: GenShen: Dirty cards for objects that get\n promoted by safepoint that intervenes between allocation and\n stores\n + JDK-8367722: [GenShen] ShenandoahEvacuationStats is always\n empty\n + JDK-8367949: JFR: MethodTrace double-counts methods that catch\n their own exceptions\n + JDK-8368001: java/text/Format/NumberFormat/\n /NumberRoundTrip.java timed out\n + JDK-8368015: Shenandoah: fix error in computation of average\n allocation rate\n + JDK-8368041: Enhance TLS certificate handling\n + JDK-8368159: Significant performance overhead when started\n with jdwp agent and unattached debugger\n + JDK-8368181: ProblemList java/awt/Dialog/ModalExcludedTest/\n /ModalExcludedTest.java\n + JDK-8368307: Shenandoah: get_next_bit_impl should special case\n weak and strong mark bits\n + JDK-8368499: GenShen: Do not collect age census during evac\n when adaptive tenuring is disabled\n + JDK-8368501: Shenandoah: GC progress evaluation does not use\n generation\n + JDK-8368524: Tests are skipped and shown as passed in test/\n /jdk/sun/security/pkcs11/Cipher/KeyWrap\n + JDK-8368681: Shenandoah: Add documentation comments for\n ShenandoahAllocationRate\n + JDK-8369128: ProblemList jdk/jfr/event/profiling/\n /TestCPUTimeSampleQueueAutoSizes.java in Xcomp configs\n + JDK-8369132: Disable vmTestbase/gc/vector/CircularListLow and\n LinearListLow with SerialGC\n + JDK-8369133: Disable gc/g1/TestShrinkAuxiliaryDataRunner.java\n with UseLargePages option\n + JDK-8369251: Opensource few tests\n + JDK-8369561: sun/java2d/OpenGL/DrawBitmaskImage.java#id0:\n Incorrect color for first pixel (actual=ff000000)\n + JDK-8369683: Exclude runtime/Monitor/\n /MonitorWithDeadObjectTest.java#DumpThreadsBeforeDetach on\n Alpine Linux debug\n + JDK-8369736: Add management interface for AOT cache creation\n + JDK-8369817: [TESTBUG] EmptyPath::toString is ignored\n + JDK-8369912: [TESTBUG] testlibrary_tests/template_framework/\n /examples/TestExpressions.java fails with ArithmeticException:\n / by zero - forgot to respect Expression.info\n + JDK-8369950: TLS connection to IPv6 address fails with BCJSSE\n due to IllegalArgumentException\n + JDK-8370370: Add still more cases to WorstCaseTests\n + JDK-8370489: Some compiler tests miss the @key randomness\n + JDK-8370502: C2: segfault while adding node to IGVN worklist\n + JDK-8370521: GenShen: Various code cleanup related to\n promotion\n + JDK-8370939: C2: SIGSEGV in SafePointNode::verify_input when\n processing MH call from\n Compile::process_late_inline_calls_no_inline()\n + JDK-8371284: GenShen: Avoid unnecessary card marking\n + JDK-8371381: [Shenandoah] Setting ergo flags should use\n FLAG_SET_ERGO\n + JDK-8371503: RETAIN_IMAGE_AFTER_TEST do not work for some\n tests\n + JDK-8371792: Refactor barrier loop tests out of TestIfMinMax\n + JDK-8371893: [macOS] use dead_strip linker option to reduce\n binary size\n + JDK-8372272: Hotspot shared lib loading - add load attempts to\n Events::log\n + JDK-8372351: Add 2 WISeKey roots\n + JDK-8372380: Make hs_err reporting more robust for unattached\n threads\n + JDK-8372513: Shenandoah: ShenandoahMaxRegionSize can produce\n an unaligned heap alignment\n + JDK-8372851: Modify java/io/File/GetXSpace.java to print path\n on failure of native call\n + JDK-8372861: Genshen: Override parallel_region_stride of\n ShenandoahResetBitmapClosure to a reasonable value for better\n parallelism\n + JDK-8373039: Remove Incorrect Asserts in\n shenandoahScanRemembered\n + JDK-8373120: Virtual thread stuck in BLOCKED state\n + JDK-8373239: Test java/awt/print/PrinterJob/PageRanges.java\n fails with incorrect selection of printed pages\n + JDK-8373275: Improve DTLS handshaking\n + JDK-8373515: Migrate \"test/jdk/java/net/httpclient/\" to\n null-safe \"SimpleSSLContext\" methods\n + JDK-8373579: Problem list compiler/runtime/Test7196199.java\n + JDK-8373650: Test \"javax/swing/JMenuItem/6458123/\n /ManualBug6458123.java\" fails because the check icons are not\n aligned properly as expected\n + JDK-8373676: Test javax/net/ssl/HttpsURLConnection/\n /SubjectAltNameIP.java fails on a machine without IPV6\n + JDK-8373690: Unexpected Keystore message using\n jdk.crypto.disabledAlgorithms\n + JDK-8373714: Shenandoah: Register heuristic penalties\n following a degenerated GC\n + JDK-8373718: jdk/internal/misc/VM/RuntimeArguments.java test\n fails in Virtual threads mode\n + JDK-8373796: Refactor java/net/httpclient/\n /ThrowingPublishers*.java tests to use JUnit5\n + JDK-8373847: Test javax/swing/JMenuItem/MenuItemTest/\n /bug6197830.java failed because The test case automatically\n fails when clicking any items in the \"Nothing\" menu in all\n four windows (Left-to-right)-Menu Item Test and\n (Right-to-left)-Menu Item Test\n + JDK-8373866: Refactor java/net/httpclient/\n /ThrowingSubscribers*.java tests to use JUnit5\n + JDK-8373893: Refactor networking http server tests to use\n JUnit\n + JDK-8373913: Refactor serialization tests to use JUnit\n + JDK-8373928: 4 Dangling pointer defect groups in java.c\n + JDK-8374001: sun/security/ skip without Exceptions\n + JDK-8374058: Enhance JPEG handling\n + JDK-8374168: Resolve disabled warnings in JDWP agent\n + JDK-8374304: MultiResolutionSplashTest.java fails in CI:\n \"Image with wrong resolution is used for splash screen!\"\n + JDK-8374322: TestMemoryWithSubgroups.java fails Permission\n denied\n + JDK-8374343: Fix SIGSEGV when lib/modules is unreadable\n + JDK-8374449: Shenandoah: Leaf locks used by Shenandoah need\n lower ranks\n + JDK-8374506: Incorrect positioning of arrow icon in parent\n JMenu in Windows L\u0026F\n + JDK-8374712: AOTMappedHeapWriter::relocate_field_in_buffer\n should use CompressedOops::narrow_oop_cast\n + JDK-8374727: Audio configuration Platform class - use nio for\n getting endianness of the underlying platform\n + JDK-8374744: Enable dumping of APX EGPRs (R16--R31) in JVM\n fatal error logs\n + JDK-8374769: PPC: MASM::pop_cont_fastpath() should reset\n _cont_fastpath if SP == _cont_fastpath\n + JDK-8374888: Implement internal test cache to help\n UserIterCount test performance\n + JDK-8374998: Failing os::write - remove bad file\n + JDK-8375065: Update LCMS to 2.18\n + JDK-8375177: Gtest\n os_linux.decoder_get_source_info_valid_vm fails with\n -ffunction-sections\n + JDK-8375294: (fs) Files.copy can fail with EOPNOTSUPP when\n copy_file_range not supported\n + JDK-8376031: HttpsURLConnection.getServerCertificates() throws\n \"java.lang.IllegalStateException: connection not yet open\" for\n the HEAD method\n + JDK-8376104: C2 crashes in PhiNode::Ideal(PhaseGVN*, bool)\n accessing NULL pointer\n + JDK-8376151: Test javax/swing/JFileChooser/4966171/\n /bug4966171.java is failing with OOME\n + JDK-8376152: Test javax/sound/sampled/Clip/bug5070081.java\n timed out then completed\n + JDK-8376185: NoSuchFieldError thrown after a record with type\n annotation retransformed\n + JDK-8376233: Clean up code in Desktop native peer\n + JDK-8376287: Crashes when using -XX:ObjArrayMarkingStride=0\n + JDK-8376402: Dependencies::print_statistics() and\n AbstractClassHierarchyWalker::print_statistics() are not\n called from PRODUCT code\n + JDK-8376684: Compile OpenJDK in headless mode without required\n X11 libraries\n + JDK-8376956: Add JVMTI phase entering/setting to hserr event\n log\n + JDK-8376969: Shenandoah: GC state getters should be inlineable\n + JDK-8376970: Shenandoah: Verifier should do basic verification\n before touching oops\n + JDK-8377158: Enhance XBM image support\n + JDK-8377167: javax/imageio/ReadAbortTest.java throw NPE when\n x11 unavailable\n + JDK-8377498: Improve HttpServer handling\n + JDK-8377512: AOT cache creation fails with invalid native\n pointer\n + JDK-8377602: Create automated test for PageRange\n + JDK-8377727: Ghost caret and focus appear in non-editable\n text fields\n + JDK-8377833: Enhance Jar file processing\n + JDK-8377907: (process) Race in ProcessBuilder can cause JVM\n hangs\n + JDK-8377910: Minor cleanup of java/io/FileDescriptor/\n /Sharing.java\n + JDK-8377932: AOT cache is not rejected when JAR file has\n changed\n + JDK-8377944: LowMemoryTest2.java#id1 intermittent fails OOME:\n Metaspace\n + JDK-8377949: TestZRelocationSetEvent.java intermittent fails\n OOME\n + JDK-8378083: Mark shenandoah/generational/\n /TestOldGrowthTriggers.java as flagless\n + JDK-8378201: [OGL] glXMakeContextCurrent() drops the buffers\n of the unbound drawable\n + JDK-8378417: Printing All pages results in NPE for 1.1\n PrintJob\n + JDK-8378561: Mark gc/shenandoah/compiler/\n /TestLinkToNativeRBP.java as /native\n + JDK-8378687: Improve delegation of HttpURLConnection\n + JDK-8378727: [macOS] Missing dispatch_release for semaphores\n in CDesktopPeer\n + JDK-8378746: ZGC: jdk/jfr/event/gc/detailed/\n /TestZRelocationSetGroupEvent.java intermittent OOME\n + JDK-8378764: fileStream::fileSize() fails for \u003e2GB files on\n Windows\n + JDK-8378774: Bump update version for OpenJDK: jdk-25.0.4\n + JDK-8378810: Enable missing FFM test via jtreg requires for\n RISC-V\n + JDK-8378836: Enable linktime-gc by default on Linux ppc64le\n + JDK-8378878: Refactor java/nio/channels/\n /AsynchronousSocketChannel test to use JUnit\n + JDK-8378888: jdk/incubator/vector/\n /Float16OperationsBenchmark.java uses wrong package name\n + JDK-8379021: Shenandoah: Speedup ShenandoahSimpleBitMapTest\n + JDK-8379202: Support linktime-gc on Linux with clang\n + JDK-8379416: AIX build fails if system (not GNU) date tool is\n in PATH\n + JDK-8379425: Windows and macOS should not allow unsupported\n headless-only build\n + JDK-8379457: Test EATests.java#id0 ERROR: monitor list errors:\n error_cnt=1\n + JDK-8379464: Enable missing stack walking test via jtreg\n requires for RISC-V\n + JDK-8379499: [AIX] headless-only build of libjawt.so fails\n + JDK-8379515: draft-ietf-lamps-kyber-certificates is now\n RFC 9935\n + JDK-8380011: Path-to-gcroots search should not trigger stack\n overflows\n + JDK-8380041: PPC: remove POWER6 remnants\n + JDK-8380222: Refactor test/jdk/java/lang/Character TestNG\n tests to JUnit\n + JDK-8380316: Test runtime/os/AvailableProcessors.java fails\n Invalid argument\n + JDK-8380409: JVM crashes when -XX:AOTMode=create uses\n app.aotconf generated with JVMTI agent\n + JDK-8380428: ProblemList containers/docker/\n /TestJcmdWithSideCar.java on linux-all\n + JDK-8380431: Shenandoah: Concurrent modification of\n stack-chunk objects during evacuation\n + JDK-8380474: Crash SEGV in ThreadIdTable::lazy_initialize\n after JDK-8323792\n + JDK-8380565: PPC64: deoptimization stub should save vector\n registers\n + JDK-8380663: Update jcmd man page to include AOT.end_recording\n diagnostic command\n + JDK-8380672: Improve certification checking\n + JDK-8380846: GenShen: Remove the experimental option to\n disable adaptive tenuring\n + JDK-8380947: Add pull request template\n + JDK-8381039: Enhance AWT ImagingLib\n + JDK-8381049: Enhance Jar handling\n + JDK-8381205: GHA: Upgrade Node.js 20 to 24\n + JDK-8381315: compiler/vectorapi/TestVectorReallocation.java\n fails with -XX:UseAVX=1 after JDK-8380565\n + JDK-8381382: Shenandoah: assert(capacity \u003e 0) failed: free\n regions must have allocation capacity\n + JDK-8381519: Enhance Der Value Handling\n + JDK-8381796: Enhance Certificate parsing\n + JDK-8381871: GenShen: ShenandoahGCHeuristics flag not reset\n after ignoring non-adaptive value\n + JDK-8381935: Improve numChunks range in the PPC64 CallAranger\n + JDK-8381937: Make exceptions in\n Java_sun_security_mscapi_CKeyPairGenerator generateCKeyPair\n more specific\n + JDK-8382018: test/jdk/java/nio/file/spi/\n /SetDefaultProvider.java leaves a directory in /tmp\n + JDK-8382020: Time Zone Abbreviation Not Localized for\n Non-English Locales\n + JDK-8382035: [ubsan] Under UBSAN builds, disable tests that\n rely on simulated JVM crashes\n + JDK-8382090: Remove .rej and .orig from .gitignore\n + JDK-8382242: JFR: Metadata reconstruction invalidates\n ConstantMap for java.lang.String\n + JDK-8382295: Shenandoah: wrong denominator in full gc summary\n + JDK-8382395: Disable stringop-overflow in\n shenandoahGenerationalHeap.cpp\n + JDK-8382419: Add missed @key randomness after JDK-8370489\n + JDK-8382522: Disable stringop-overflow in\n safepointMechanism.cpp\n + JDK-8382740: JFR: Disable jdk.OldObjectSample event for\n generational ZGC\n + JDK-8382878: RISC-V: Missing InlineSkippedInstructionsCounter\n in ZGC barriers stubs\n + JDK-8382932: [25u] Test java/lang/instrument/\n /RetransformRecordTypeAnn/TestRetransformRecord.java\u200e fails\n with compilation error\n + JDK-8383161: [PPC64]\n MachCallDynamicJavaNode::ret_addr_offset() needs adaptation\n for COH\n + JDK-8383175: (tz) Update Timezone Data to 2026b\n + JDK-8383183: Shenandoah: Mangle trashed regions up to top\n instead of end\n + JDK-8383354: Update LCMS to 2.19.1\n + JDK-8383473: Follow on from tzdata2026b time change to\n include temporary hack BC time change\n + JDK-8383601: RISC-V:\n ShenandoahBarrierSetAssembler::load_reference_barrier calls\n \"weak\" on \"phantom\" path\n + JDK-8383630: Fix iteration in tests doing class redefinition\n + JDK-8384043: [REDO] Incorrect handling of Hawaii_Aleutian\n metazone\n + JDK-8384158: GHA: Downgrade Windows GHA runners to\n windows-2022 temporarily\n + JDK-8384163: (so) SocketChannel.connect and finishConnect()\n exception messages could be improved\n + JDK-8384223: RISC-V: entry_barrier_offset should consider\n UseZtso\n + JDK-8384486: NTLM tests fail on Windows 11 and Windows Server\n 2025\n + JDK-8384495: Update Libpng to 1.6.58\n + JDK-8384540: [25u, 21u, 17u] Update GHA JDKs after Apr/26\n updates\n + JDK-8384815: SelectOneKeyOutOfMany and PreferredKey fail after\n expired test certificate\n + JDK-8384902: Update GIFlib to 6.1.3\n + JDK-8385390: Update FreeType to 2.14.3\n + JDK-8385490: Update HarfBuzz to 14.2.0\n + JDK-8386551: Windows build broken because of MSys2/Make update\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Leap-16.0-1382",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21467-1.json"
},
{
"category": "self",
"summary": "SUSE Bug 1264994",
"url": "https://bugzilla.suse.com/1264994"
},
{
"category": "self",
"summary": "SUSE Bug 1272223",
"url": "https://bugzilla.suse.com/1272223"
},
{
"category": "self",
"summary": "SUSE Bug 1272224",
"url": "https://bugzilla.suse.com/1272224"
},
{
"category": "self",
"summary": "SUSE Bug 1272225",
"url": "https://bugzilla.suse.com/1272225"
},
{
"category": "self",
"summary": "SUSE Bug 1272227",
"url": "https://bugzilla.suse.com/1272227"
},
{
"category": "self",
"summary": "SUSE Bug 1272228",
"url": "https://bugzilla.suse.com/1272228"
},
{
"category": "self",
"summary": "SUSE Bug 1272235",
"url": "https://bugzilla.suse.com/1272235"
},
{
"category": "self",
"summary": "SUSE Bug 1272236",
"url": "https://bugzilla.suse.com/1272236"
},
{
"category": "self",
"summary": "SUSE Bug 1272237",
"url": "https://bugzilla.suse.com/1272237"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41254 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41254/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46917 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46917/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46968 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46968/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-47010 page",
"url": "https://www.suse.com/security/cve/CVE-2026-47010/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-47021 page",
"url": "https://www.suse.com/security/cve/CVE-2026-47021/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-47027 page",
"url": "https://www.suse.com/security/cve/CVE-2026-47027/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-47059 page",
"url": "https://www.suse.com/security/cve/CVE-2026-47059/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-47063 page",
"url": "https://www.suse.com/security/cve/CVE-2026-47063/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-60147 page",
"url": "https://www.suse.com/security/cve/CVE-2026-60147/"
}
],
"title": "Security update for java-25-openjdk",
"tracking": {
"current_release_date": "2026-09-17T17:40:26Z",
"generator": {
"date": "2026-07-28T16:12:30Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:21467-1",
"initial_release_date": "2026-07-28T16:12:30Z",
"revision_history": [
{
"date": "2026-07-28T16:12:30Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-07-28T16:12:30Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-09-16T20:43:32Z",
"number": "3",
"summary": "unknown changes"
},
{
"date": "2026-09-16T21:45:15Z",
"number": "4",
"summary": "unknown changes"
},
{
"date": "2026-09-17T17:40:26Z",
"number": "5",
"summary": "unknown changes"
}
],
"status": "final",
"version": "5"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"product": {
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"product_id": "java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk@25.0.4.0-160000.1.1?arch=aarch64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"product": {
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"product_id": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-demo@25.0.4.0-160000.1.1?arch=aarch64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"product": {
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"product_id": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-devel@25.0.4.0-160000.1.1?arch=aarch64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"product": {
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"product_id": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-headless@25.0.4.0-160000.1.1?arch=aarch64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"product": {
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"product_id": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-jmods@25.0.4.0-160000.1.1?arch=aarch64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"product": {
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"product_id": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-src@25.0.4.0-160000.1.1?arch=aarch64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"product": {
"name": "java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"product_id": "java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-javadoc@25.0.4.0-160000.1.1?arch=noarch\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"product": {
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"product_id": "java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk@25.0.4.0-160000.1.1?arch=ppc64le\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"product": {
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"product_id": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-demo@25.0.4.0-160000.1.1?arch=ppc64le\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"product": {
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"product_id": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-devel@25.0.4.0-160000.1.1?arch=ppc64le\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"product": {
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"product_id": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-headless@25.0.4.0-160000.1.1?arch=ppc64le\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"product": {
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"product_id": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-jmods@25.0.4.0-160000.1.1?arch=ppc64le\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"product": {
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"product_id": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-src@25.0.4.0-160000.1.1?arch=ppc64le\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"product": {
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"product_id": "java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk@25.0.4.0-160000.1.1?arch=s390x\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"product": {
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"product_id": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-demo@25.0.4.0-160000.1.1?arch=s390x\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"product": {
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"product_id": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-devel@25.0.4.0-160000.1.1?arch=s390x\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"product": {
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"product_id": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-headless@25.0.4.0-160000.1.1?arch=s390x\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"product": {
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"product_id": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-jmods@25.0.4.0-160000.1.1?arch=s390x\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"product": {
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"product_id": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-src@25.0.4.0-160000.1.1?arch=s390x\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"product": {
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"product_id": "java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk@25.0.4.0-160000.1.1?arch=x86_64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"product": {
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"product_id": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-demo@25.0.4.0-160000.1.1?arch=x86_64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"product": {
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"product_id": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-devel@25.0.4.0-160000.1.1?arch=x86_64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"product": {
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"product_id": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-headless@25.0.4.0-160000.1.1?arch=x86_64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"product": {
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"product_id": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-jmods@25.0.4.0-160000.1.1?arch=x86_64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64",
"product": {
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64",
"product_id": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:oracle:openjdk:25.0.4.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/java-25-openjdk-src@25.0.4.0-160000.1.1?arch=x86_64\u0026upstream=java-25-openjdk-0:25.0.4.0-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 16.0",
"product": {
"name": "openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64"
},
"product_reference": "java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le"
},
"product_reference": "java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x"
},
"product_reference": "java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64"
},
"product_reference": "java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64"
},
"product_reference": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le"
},
"product_reference": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x"
},
"product_reference": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64"
},
"product_reference": "java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64"
},
"product_reference": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le"
},
"product_reference": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x"
},
"product_reference": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64"
},
"product_reference": "java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64"
},
"product_reference": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le"
},
"product_reference": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x"
},
"product_reference": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64"
},
"product_reference": "java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch"
},
"product_reference": "java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64"
},
"product_reference": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le"
},
"product_reference": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x"
},
"product_reference": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64"
},
"product_reference": "java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64"
},
"product_reference": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le"
},
"product_reference": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x"
},
"product_reference": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
},
"product_reference": "java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-41254",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41254"
}
],
"notes": [
{
"category": "general",
"text": "Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41254",
"url": "https://www.suse.com/security/cve/CVE-2026-41254"
},
{
"category": "external",
"summary": "SUSE Bug 1264994 for CVE-2026-41254",
"url": "https://bugzilla.suse.com/1264994"
},
{
"category": "external",
"summary": "SUSE Bug 1272458 for CVE-2026-41254",
"url": "https://bugzilla.suse.com/1272458"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.9,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T16:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-41254"
},
{
"cve": "CVE-2026-46917",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46917"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46917",
"url": "https://www.suse.com/security/cve/CVE-2026-46917"
},
{
"category": "external",
"summary": "SUSE Bug 1272223 for CVE-2026-46917",
"url": "https://bugzilla.suse.com/1272223"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T16:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-46917"
},
{
"cve": "CVE-2026-46968",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46968"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46968",
"url": "https://www.suse.com/security/cve/CVE-2026-46968"
},
{
"category": "external",
"summary": "SUSE Bug 1272224 for CVE-2026-46968",
"url": "https://bugzilla.suse.com/1272224"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T16:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-46968"
},
{
"cve": "CVE-2026-47010",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-47010"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-47010",
"url": "https://www.suse.com/security/cve/CVE-2026-47010"
},
{
"category": "external",
"summary": "SUSE Bug 1272225 for CVE-2026-47010",
"url": "https://bugzilla.suse.com/1272225"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T16:12:30Z",
"details": "low"
}
],
"title": "CVE-2026-47010"
},
{
"cve": "CVE-2026-47021",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-47021"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-47021",
"url": "https://www.suse.com/security/cve/CVE-2026-47021"
},
{
"category": "external",
"summary": "SUSE Bug 1272227 for CVE-2026-47021",
"url": "https://bugzilla.suse.com/1272227"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T16:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-47021"
},
{
"cve": "CVE-2026-47027",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-47027"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-47027",
"url": "https://www.suse.com/security/cve/CVE-2026-47027"
},
{
"category": "external",
"summary": "SUSE Bug 1272228 for CVE-2026-47027",
"url": "https://bugzilla.suse.com/1272228"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T16:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-47027"
},
{
"cve": "CVE-2026-47059",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-47059"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-47059",
"url": "https://www.suse.com/security/cve/CVE-2026-47059"
},
{
"category": "external",
"summary": "SUSE Bug 1272235 for CVE-2026-47059",
"url": "https://bugzilla.suse.com/1272235"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T16:12:30Z",
"details": "low"
}
],
"title": "CVE-2026-47059"
},
{
"cve": "CVE-2026-47063",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-47063"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-47063",
"url": "https://www.suse.com/security/cve/CVE-2026-47063"
},
{
"category": "external",
"summary": "SUSE Bug 1272236 for CVE-2026-47063",
"url": "https://bugzilla.suse.com/1272236"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T16:12:30Z",
"details": "important"
}
],
"title": "CVE-2026-47063"
},
{
"cve": "CVE-2026-60147",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-60147"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-60147",
"url": "https://www.suse.com/security/cve/CVE-2026-60147"
},
{
"category": "external",
"summary": "SUSE Bug 1272237 for CVE-2026-60147",
"url": "https://bugzilla.suse.com/1272237"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-demo-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-devel-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-headless-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-javadoc-0:25.0.4.0-160000.1.1.noarch",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-jmods-0:25.0.4.0-160000.1.1.x86_64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.aarch64",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.ppc64le",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.s390x",
"openSUSE Leap 16.0:java-25-openjdk-src-0:25.0.4.0-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T16:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2026-60147"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.