{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for OpenJDK.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.\n\nThis release of the Red Hat build of OpenJDK 21 (21.0.9) for Windows serves as a replacement for the Red Hat build of OpenJDK 21 (21.0.8) and includes security and bug fixes. For further information, refer to the release notes linked to in the References section.\n\nSecurity Fix(es):\n\n* JDK: Enhance Path Factories (CVE-2025-53066)\n\n* JDK: Enhance Certificate Handling (CVE-2025-53057)\n\n* JDK: Enhance String Handling (CVE-2025-61748)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:18826",
        "url": "https://access.redhat.com/errata/RHSA-2025:18826"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_build_of_openjdk/21/html/release_notes_for_red_hat_build_of_openjdk_21.0.9/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_build_of_openjdk/21/html/release_notes_for_red_hat_build_of_openjdk_21.0.9/index"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_18826.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenJDK 21.0.9 Security Update for Windows Builds",
    "tracking": {
      "current_release_date": "2026-10-16T10:09:19+00:00",
      "generator": {
        "date": "2026-10-16T10:09:19+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2025:18826",
      "initial_release_date": "2025-10-22T19:46:43+00:00",
      "revision_history": [
        {
          "date": "2025-10-22T19:46:43+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-10-22T19:46:43+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-16T10:09:19+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Build of OpenJDK 21.0.9",
                "product": {
                  "name": "Red Hat Build of OpenJDK 21.0.9",
                  "product_id": "Red Hat Build of OpenJDK 21.0.9",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openjdk:21"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "OpenJDK"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-53057",
      "cwe": {
        "id": "CWE-838",
        "name": "Inappropriate Encoding for Output Context"
      },
      "discovery_date": "2025-10-10T13:10:43.956000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2403082"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and  21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance certificate handling (Oracle CPU 2025-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A moderate severity flaw was found in OpenJDK certificate handling: in certain cases, Java APIs may return Distinguished Name (DN) strings that are incorrect representations of the encoded form of BMPString, PrintableString, and IA5String. An unauthenticated attacker with network access who can supply crafted data to the affected Java APIs, for example through a web service, could exploit this flaw to gain unauthorized modification access to data accessible to the Java runtime. The vulnerability is difficult to exploit and impacts integrity only; it is also relevant to Java deployments that load and run untrusted code while relying on the Java sandbox, such as sandboxed Java Web Start applications or applets. Red Hat rated this flaw Moderate (CVSS 3.1 base score 5.9, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N), consistent with the upstream Oracle severity. Multiple Red Hat Enterprise Linux java-1.8.0-openjdk, java-17-openjdk, java-21-openjdk, and java-1.8.0-ibm update streams are affected; other streams were determined to be not affected because the vulnerable code is not present. Because resolution of the affected streams is delegated, a fix is being pursued through the upstream OpenJDK project.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 21.0.9"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-53057"
        },
        {
          "category": "external",
          "summary": "RHBZ#2403082",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2403082"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53057",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-53057"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53057",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53057"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2025.html#AppendixJAVA",
          "url": "https://www.oracle.com/security-alerts/cpuoct2025.html#AppendixJAVA"
        }
      ],
      "release_date": "2025-10-21T22:22:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-10-22T19:46:43+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 21.0.9"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:18826"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Users are advised to install the latest available OpenJDK package updates through Red Hat errata as they are released.",
          "product_ids": [
            "Red Hat Build of OpenJDK 21.0.9"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 21.0.9"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance certificate handling (Oracle CPU 2025-10)"
    },
    {
      "cve": "CVE-2025-53066",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2025-10-10T11:32:12.701000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2403063"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and  21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance Path Factories (Oracle CPU 2025-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A moderate severity flaw was found in the Java API for XML Processing (JAXP) in OpenJDK as shipped in Red Hat Enterprise Linux and the Red Hat Build of OpenJDK. When applications evaluated XML through the javax.xml.xpath.XPathFactory APIs, the configured external entity access restrictions and secure processing settings were not enforced on the underlying XML parser. An unauthenticated remote attacker who can supply untrusted XML to an application that processes it with the affected APIs, for example a web service that feeds user-supplied data to these APIs, could use crafted XML with external entities (XXE) or excessive entity expansion (XEE) to read data accessible to the Java process or affect its availability. The java-1.8.0-openjdk, java-17-openjdk, java-21-openjdk, and java-25-openjdk packages in Red Hat Enterprise Linux 7 through 10, the IBM and Semeru Java builds, and the Red Hat Build of OpenJDK 8, 11, 17, and 21 streams are affected; resolution is delegated to the responsible Red Hat Java maintenance streams, which are pursuing and delivering fixes for the affected products, while older out-of-support streams are not slated to receive them. The Red Hat Enterprise Linux 9.7.z and 10.1.z streams marked not affected already contain the fix, so the vulnerable code is not present there. Red Hat Product Security rates this flaw moderate rather than the upstream important severity because exploitation requires an application to pass attacker-controlled XML to the affected JAXP APIs, giving the attack high complexity, and the expected confidentiality and availability impacts are limited in typical Red Hat deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 21.0.9"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-53066"
        },
        {
          "category": "external",
          "summary": "RHBZ#2403063",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2403063"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-53066",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-53066"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-53066",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53066"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2025.html#AppendixJAVA",
          "url": "https://www.oracle.com/security-alerts/cpuoct2025.html#AppendixJAVA"
        }
      ],
      "release_date": "2025-10-21T22:22:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-10-22T19:46:43+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 21.0.9"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:18826"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Build of OpenJDK 21.0.9"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 21.0.9"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance Path Factories (Oracle CPU 2025-10)"
    },
    {
      "cve": "CVE-2025-61748",
      "cwe": {
        "id": "CWE-581",
        "name": "Object Model Violation: Just One of Equals and Hashcode Defined"
      },
      "discovery_date": "2025-10-10T11:38:14.887000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2403064"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 21.0.8 and  25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance String handling (Oracle CPU 2025-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A moderate security impact flaw was found in the OpenJDK String handling code, affecting the java-21-openjdk and java-25-openjdk packages in Red Hat Enterprise Linux 8, 9, and 10 and the java-21-openjdk-portable and java-21-openjdk-windows builds of the Red Hat Build of OpenJDK 21. After the JDK-8282429 change in JDK 19, certain Strings built using StringBuilder return an incorrect result for String.equals() checks. This is a difficult-to-exploit flaw that can be triggered by an unauthenticated attacker with network access who supplies data to APIs in the affected component, for example through a web service that passes data to those APIs, or in Java deployments, typically clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code and rely on the Java sandbox for security. Successful attacks can result in unauthorized update, insert, or delete access to some of the data accessible to the affected Java runtime; confidentiality and availability are not impacted. Both Red Hat and the upstream record assign this flaw a CVSS 3.1 base score of 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). A fix is being pursued for the affected products. Red Hat builds of Java 1.6.0, 1.7.0, 1.8.0, 11, and 17, the IBM Semeru Certified 21 builds, and java-21-openjdk update streams that already contain the corrected code are not affected because the vulnerable code is not present in those versions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 21.0.9"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61748"
        },
        {
          "category": "external",
          "summary": "RHBZ#2403064",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2403064"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61748",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61748"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61748",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61748"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2025.html#AppendixJAVA",
          "url": "https://www.oracle.com/security-alerts/cpuoct2025.html#AppendixJAVA"
        }
      ],
      "release_date": "2025-10-21T22:22:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-10-22T19:46:43+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 21.0.9"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:18826"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Build of OpenJDK 21.0.9"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 21.0.9"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance String handling (Oracle CPU 2025-10)"
    }
  ]
}