{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for OpenJDK.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The OpenJDK 8 packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.\n\nThis release of the Red Hat build of OpenJDK 8 (8u462) for portable Linux serves as a replacement for Red Hat build of OpenJDK 8 (8u452) and includes security and bug fixes as well as enhancements. For further information, refer to the release notes linked to in the References section.\n\nSecurity Fix(es):\n\n* JDK: Better Glyph drawing (CVE-2025-30749)\n* JDK: Enhance TLS protocol support (CVE-2025-30754)\n* JDK: Improve scripting supports (CVE-2025-30761)\n* JDK: Better Glyph drawing redux (CVE-2025-50106)\n\nBug Fix(es):\n\n* On certain system configurations where the IPv4 stack was preferred over IPv6 (either due to -Djava.net.preferIPv4Stack=true being specified or no IPv6 interfaces being present), the method java.net.InetAddress.getLocalHost().getHostName() would return the fully qualified hostname instead of the short hostname. This behavior was only ever intended for Solaris systems and it deviated from the method\u0027s behavior for IPv6 interfaces. In this release, the method will return the short hostname on all interfaces. (OPENJDK-3966)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:10863",
        "url": "https://access.redhat.com/errata/RHSA-2025:10863"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_build_of_openjdk/8/html/release_notes_for_red_hat_build_of_openjdk_8.0.462/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_build_of_openjdk/8/html/release_notes_for_red_hat_build_of_openjdk_8.0.462/index"
      },
      {
        "category": "external",
        "summary": "OPENJDK-3966",
        "url": "https://issues.redhat.com/browse/OPENJDK-3966"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10863.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenJDK 8u462 Security Update for Portable Linux Builds",
    "tracking": {
      "current_release_date": "2026-10-16T10:08:56+00:00",
      "generator": {
        "date": "2026-10-16T10:08:56+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2025:10863",
      "initial_release_date": "2025-07-17T16:20:40+00:00",
      "revision_history": [
        {
          "date": "2025-07-17T16:20:40+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-07-17T16:20:40+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-16T10:08:56+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Build of OpenJDK 8u462",
                "product": {
                  "name": "Red Hat Build of OpenJDK 8u462",
                  "product_id": "Red Hat Build of OpenJDK 8u462",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openjdk:1.8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "OpenJDK"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-30749",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "discovery_date": "2025-07-07T10:35:26.542000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2376783"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and  24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Better Glyph drawing (Oracle CPU 2025-07)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the Java 2D glyph drawing code of OpenJDK, rated by Red Hat as having an impact of Important. Several scenarios of heap corruption can be triggered through Graphics2D.drawString(String,float,float) with varying RenderingHints and affine font transformation settings. This difficult-to-exploit vulnerability allows an unauthenticated remote attacker with network access to compromise affected Java runtimes, with high impact to confidentiality, integrity, and availability. The vulnerability applies to Java deployments that load and run untrusted code and rely on the Java sandbox for security, such as clients running sandboxed Java Web Start applications or applets; it does not apply to Java deployments, typically servers, that load and run only trusted code. Red Hat Enterprise Linux is affected through its OpenJDK and IBM Java packages (including java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, java-21-openjdk, and java-1.8.0-ibm) across multiple RHEL releases and update streams, and fixes are being pursued for the affected streams. Red Hat\u0027s severity assessment matches the upstream rating of CVSS 3.1 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 8u462"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-30749"
        },
        {
          "category": "external",
          "summary": "RHBZ#2376783",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376783"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-30749",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-30749"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-30749",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30749"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpujul2025.html#AppendixJAVA",
          "url": "https://www.oracle.com/security-alerts/cpujul2025.html#AppendixJAVA"
        }
      ],
      "release_date": "2025-07-15T20:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-07-17T16:20:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 8u462"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:10863"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Build of OpenJDK 8u462"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 8u462"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openjdk: Better Glyph drawing (Oracle CPU 2025-07)"
    },
    {
      "cve": "CVE-2025-30754",
      "cwe": {
        "id": "CWE-325",
        "name": "Missing Cryptographic Step"
      },
      "discovery_date": "2025-07-07T10:43:37.755000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2376784"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and  24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance TLS protocol support (Oracle CPU 2025-07)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in the Java Secure Socket Extension (JSSE) component of OpenJDK, as packaged in Red Hat Enterprise Linux. This moderate severity vulnerability (CVSS 3.1 base score 4.8, matching the upstream Oracle score) means the JSSE client can complete a TLS 1.3 handshake without receiving the EncryptedExtensions message, weakening the protections that TLS provides. A remote, unauthenticated attacker with network access via TLS could exploit this difficult-to-exploit issue to gain unauthorized read access and unauthorized update, insert, or delete access to a subset of accessible data. Per the upstream advisory, this issue applies to Java deployments that load and run untrusted code, such as clients running sandboxed Java Web Start applications or sandboxed Java applets that rely on the Java sandbox for security; it does not apply to Java deployments, typically servers, that load and run only trusted code. Fixes for the affected Red Hat Enterprise Linux OpenJDK packages are being pursued through errata updates.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 8u462"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-30754"
        },
        {
          "category": "external",
          "summary": "RHBZ#2376784",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376784"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-30754",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-30754"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-30754",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30754"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpujul2025.html#AppendixJAVA",
          "url": "https://www.oracle.com/security-alerts/cpujul2025.html#AppendixJAVA"
        }
      ],
      "release_date": "2025-07-15T20:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-07-17T16:20:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 8u462"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:10863"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Affected users should apply the updated OpenJDK packages for their Red Hat Enterprise Linux stream once they are available through Red Hat errata.",
          "product_ids": [
            "Red Hat Build of OpenJDK 8u462"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 8u462"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance TLS protocol support (Oracle CPU 2025-07)"
    },
    {
      "cve": "CVE-2025-30761",
      "cwe": {
        "id": "CWE-693",
        "name": "Protection Mechanism Failure"
      },
      "discovery_date": "2025-07-07T10:50:16.559000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2376786"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Scripting).  Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and  11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Improve scripting supports (Oracle CPU 2025-07)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A moderate severity vulnerability was found in the Nashorn scripting engine of OpenJDK 8 and OpenJDK 11 as shipped by Red Hat. It affects the java-1.8.0-openjdk packages in Red Hat Enterprise Linux 7, 8, and 9, the java-1.8.0-ibm packages in Red Hat Enterprise Linux 8, and the Red Hat Build of OpenJDK 8 and 11 (java-1.8.0-openjdk-portable, java-1.8.0-openjdk-windows, java-11-openjdk-portable, java-11-openjdk-windows, and the java-11-openjdk ELS streams). The Nashorn option-processing code handled arguments that define the nashorn.args and nashorn.args.prepend configuration properties in an unintended order, so the --no-java security option, which is intended to prevent script code from accessing Java classes and APIs, could be bypassed in some cases. The vulnerability is difficult to exploit: an unauthenticated remote attacker able to supply data to the scripting APIs, for example through a web service that supplies data to those APIs, could bypass the scripting restriction and gain the ability to create, delete, or modify data accessible to the Java runtime, an integrity-only impact. Red Hat rates this flaw MODERATE with a CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N), which matches the upstream Oracle severity, so there is no difference in rating. Red Hat offerings based on Java 17 and Java 21 (java-17-openjdk, java-21-openjdk, java-21-ibm-semeru-certified-jdk, and the corresponding Red Hat Build of OpenJDK builds) are not affected because the vulnerable code is not present in those versions. The affected Java 8 and Java 11 components are delegated to their respective Red Hat product streams, where a fix is being pursued; fixes have been delivered for most affected streams, while no fix is planned for certain older java-1.8.0-ibm Red Hat Enterprise Linux 8 EUS streams, which remain exposed to the residual risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 8u462"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-30761"
        },
        {
          "category": "external",
          "summary": "RHBZ#2376786",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376786"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-30761",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-30761"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-30761",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30761"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpujul2025.html#AppendixJAVA",
          "url": "https://www.oracle.com/security-alerts/cpujul2025.html#AppendixJAVA"
        }
      ],
      "release_date": "2025-07-15T20:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-07-17T16:20:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 8u462"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:10863"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Build of OpenJDK 8u462"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 8u462"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Improve scripting supports (Oracle CPU 2025-07)"
    },
    {
      "cve": "CVE-2025-50106",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "discovery_date": "2025-07-09T15:41:11.313000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2379031"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and  24.0.1; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Glyph out-of-memory access and crash (Oracle CPU 2025-07)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An IMPORTANT severity flaw was found in the Java 2D glyph rendering code of OpenJDK. The original fix for CVE-2025-30749 was incomplete: the CGGlyphImages_GetGlyphImagePtrs method incorrectly calculates pointers to the arrays inside a pre-allocated buffer, causing an out-of-bounds memory access that can crash the Java runtime. The vulnerability is difficult to exploit and requires an unauthenticated attacker with network access to supply crafted data to the affected 2D APIs, for example through a web service that feeds data to those APIs, or in Java deployments such as sandboxed Java Web Start applications or applets that load and run untrusted code and rely on the Java sandbox for security. A successful attack can compromise the confidentiality, integrity, and availability of the Java runtime (CVSS 3.1 base score 8.1, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), consistent with the upstream severity. In Red Hat Enterprise Linux, this flaw affects java-1.8.0-openjdk, java-17-openjdk, and java-21-openjdk on multiple RHEL 7, 8, and 9 update streams, as well as java-1.8.0-ibm; fixes are being pursued through the upstream OpenJDK and IBM projects and delivered to the affected Red Hat Enterprise Linux streams via errata. The java-1.6.0-openjdk and java-1.7.0-openjdk packages in the out-of-support RHEL 6 and RHEL 7 streams are out of support and will not receive updates for this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 8u462"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-50106"
        },
        {
          "category": "external",
          "summary": "RHBZ#2379031",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379031"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-50106",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-50106"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-50106",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50106"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpujul2025.html#AppendixJAVA",
          "url": "https://www.oracle.com/security-alerts/cpujul2025.html#AppendixJAVA"
        }
      ],
      "release_date": "2025-07-15T20:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-07-17T16:20:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 8u462"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:10863"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Build of OpenJDK 8u462"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 8u462"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openjdk: Glyph out-of-memory access and crash (Oracle CPU 2025-07)"
    }
  ]
}