RHSA-2026:88353

Vulnerability from csaf_redhat - Published: 2026-10-27 19:53 - Updated: 2026-10-29 13:02
Summary
Red Hat Security Advisory: OpenJDK 17.0.21 Security Update for Portable Linux Builds
Severity
Critical
Notes
Topic: An update is now available for OpenJDK. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The OpenJDK 17 packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. This release of the Red Hat build of OpenJDK 17 (17.0.21) for portable Linux serves as a replacement for the Red Hat build of OpenJDK 17 (17.0.20 and 17.0.20.1) and includes security and bug fixes as well as enhancements. For further information, refer to the release notes linked to in the References section. Security Fix(es): * JDK: Enhance PKCS5 padding (CVE-2026-83374) * JDK: Enhance TLS certificate handling (CVE-2026-83376) * JDK: Enhance LDAP logins (CVE-2026-83380) * JDK: Enhance SASL Authentication (CVE-2026-83381) * JDK: Enhance WebRowSets (CVE-2026-83387) * JDK: Enhance HTTP Client Response Handling (CVE-2026-83395) * JDK: Enhance XML Processing (CVE-2026-83400) * JDK: Enhance XPath Expressions (CVE-2026-87290) * JDK: Enhance Network Clients (CVE-2026-87292) * JDK: Enhance Certificate Name Checks (CVE-2026-87294) * JDK: Enhance Template Handling (CVE-2026-87367) * JDK: Enhance HTTP Client (CVE-2026-91332) * JDK: Enhance JPEG loading (CVE-2026-91334) * JDK: Enhance Image Handling (CVE-2026-91335) * JDK: Enhance TLS handshakes (CVE-2026-91373) * JDK: Enhance jstatd (CVE-2026-91374) * JDK: Enhance jmod handling (CVE-2026-91375) * JDK: Enhance JShell (CVE-2026-91379) * JDK: Enhance Preferences (CVE-2026-91380) * JDK: Enhance Image Processing (CVE-2026-91382) * JDK: Enhance HTTP client caching (CVE-2026-91394) * JDK: Enhance diagnostic sessions (CVE-2026-91397) * JDK: Enhance SOCKS5 support (CVE-2026-91398) * JDK: Enhance MIDI file handling (CVE-2026-91400) * JDK: Enhance zipfs (CVE-2026-91410) * JDK: Enhance font rendering (CVE-2026-91415) * JDK: Enhance GIF loading (CVE-2026-91418) * JDK: Enhance HTTP server parsing (CVE-2026-91451) * JDK: Enhance HTTP server (CVE-2026-91452) * JDK: Improve HTTP headers (CVE-2026-91453) * JDK: Enhance TLS Extensions (CVE-2026-91461) * JDK: Enhance krb5 tokens (CVE-2026-91462) * JDK: Enhance krb5 client (CVE-2026-91463) * JDK: Enhance Kerberos validation (CVE-2026-91464) * JDK: Enhance C2 comparisons (CVE-2026-91487) * JDK: Enhance Certificate Constraint Checking (CVE-2026-101516) * JDK: Enhance Image Processing (CVE-2026-91382) * JDK: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-91403) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-83374

A flaw was found in OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by sending crafted requests across network protocols to exposed application programming interfaces (APIs) within the Security component. A successful attack can result in unauthorized modification, creation, or deletion of critical application data. In addition, the flaw may allow untrusted code running in a restricted sandbox environment to tamper with protected data.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-358 - Improperly Implemented Security Check for Standard
Affected products
Product Identifier Version Remediation
Red Hat Build of OpenJDK 17.0.21
Red Hat / OpenJDK
 cpe:/a:redhat:openjdk:17 —
Vendor Fix fix
Threats
Impact Moderate
CVE-2026-83376

A flaw was found in the Java Secure Socket Extension (JSSE) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability over a Transport Layer Security (TLS) connection to perform unauthorized modification, insertion, or deletion of accessible data. Exploitation occurs when network services or applications process untrusted network input through affected JSSE APIs, compromising data integrity.

3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Low
CVE-2026-83380

A flaw was found in OpenJDK within the Java Authentication and Authorization Service (JAAS) component. An unauthenticated remote attacker can exploit this vulnerability over a network by sending data to affected application programming interfaces (APIs). Successful exploitation results in information disclosure, granting unauthorized read access to a subset of accessible data.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-83381

A flaw was found in OpenJDK. An unauthenticated remote attacker can exploit this vulnerability over a network by supplying crafted input to Application Programming Interfaces (APIs) within the Security component. Successful exploitation can result in unauthorized read and modification access to a subset of data accessible to the application.

4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-303 - Incorrect Implementation of Authentication Algorithm
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-83387

A flaw was found in the Java Database Connectivity (JDBC) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to exposed JDBC application programming interfaces (APIs) or by executing untrusted code. If successfully exploited, this flaw allows an attacker to obtain unauthorized access to critical data, leading to information disclosure.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-611 - Improper Restriction of XML External Entity Reference
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-83395

A flaw was found in OpenJDK. An unauthenticated remote attacker with network access could exploit this vulnerability by submitting crafted data to networking application programming interfaces (APIs). A successful attack could allow unauthorized modification or deletion of accessible data, or result in a partial Denial of Service (DoS).

3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-83400

A flaw was found in the Java API for XML Processing (JAXP) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting crafted data across the network to applications that expose JAXP interfaces, such as through a web service. Successful exploitation can result in a partial Denial of Service (DoS), reducing the availability of the application.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-87290

A flaw was found in the Java API for XML Processing (JAXP) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to applications or web services that rely on vulnerable JAXP APIs. Successful exploitation can result in unauthorized information disclosure, allowing an attacker to access sensitive data managed by the Java application.

3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-91 - XML Injection (aka Blind XPath Injection)
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-87292

A flaw was found in the OpenJDK networking component. This vulnerability may allow an unauthenticated remote attacker to cause unauthorized data modification. By supplying crafted input to exposed networking application programming interfaces (APIs), such as through a web service, an attacker can insert, update, or delete a subset of accessible data.

3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Low
CVE-2026-87294

A flaw was found in OpenJDK. An unauthenticated remote attacker can exploit this issue across multiple network protocols by submitting crafted requests to application programming interfaces (APIs) within the Security component. Successful exploitation allows an attacker to modify or delete accessible application data, as well as gain unauthorized read access to sensitive information.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-87367

A flaw was found in the JAXP (Java API for XML Processing) component of OpenJDK. An unauthenticated remote attacker can exploit this vulnerability by providing crafted input to applications or web services that process data through JAXP APIs. Successful exploitation allows the attacker to perform unauthorized data modifications, including updating, inserting, or deleting accessible data.

3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-91 - XML Injection (aka Blind XPath Injection)
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Low
CVE-2026-91332

A flaw was found in OpenJDK's Networking component. An unauthenticated remote attacker with network access can exploit this vulnerability by sending crafted input to exposed networking Application Programming Interfaces (APIs). Successful exploitation allows the attacker to perform unauthorized data modifications, potentially inserting, altering, or deleting accessible application data.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-91334

A flaw was found in OpenJDK's ImageIO component. This vulnerability allows an unauthenticated remote attacker to cause information disclosure by submitting crafted inputs to applications or web services using the ImageIO application programming interface (API). Successful exploitation can result in unauthorized read access to a subset of accessible data.

3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-125 - Out-of-bounds Read
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Low
CVE-2026-91335

A flaw was found in OpenJDK's Abstract Window Toolkit (AWT). A remote attacker with low privileges could exploit this vulnerability by convincing a user to run untrusted code within a sandboxed environment. Successful exploitation allows unauthorized read access to a subset of accessible data, leading to information disclosure.

2.6 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CWE-653 - Improper Isolation or Compartmentalization
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Low
CVE-2026-91373

A flaw was found in OpenJDK's Java Secure Socket Extension (JSSE) component. An unauthenticated remote attacker with network access via Transport Layer Security (TLS) can exploit this vulnerability to cause a partial Denial of Service (DoS). This issue can be triggered when an application or web service processes untrusted network data using the affected JSSE APIs.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-91374

A flaw was found in the Serviceability component of OpenJDK. An unauthenticated remote attacker can exploit this issue across the network by supplying crafted data to exposed application programming interfaces (APIs) or by running untrusted code within a sandboxed Java environment. Successful exploitation may lead to unauthorized data access, allowing the attacker to read and modify sensitive application data.

4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-749 - Exposed Dangerous Method or Function
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-91375

A flaw was found in openjdk. An unauthenticated attacker with local access to the host system could leverage this vulnerability in the Libraries component by convincing a user to interact with a malicious application or by supplying crafted input through exposed application programming interfaces (APIs). Successful exploitation allows the attacker to compromise data integrity, resulting in the unauthorized modification, creation, or deletion of critical data accessible to the Java runtime environment.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-91379

A flaw was found in OpenJDK's JDK tools component. An unauthenticated local attacker can exploit this vulnerability by convincing a user to interact with untrusted code in an environment relying on the Java security sandbox. A successful attack can result in unauthorized creation, modification, or deletion of critical data accessible to the application.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
CWE-653 - Improper Isolation or Compartmentalization
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-91380

A flaw was found in the OpenJDK Utility component. An unauthenticated attacker with local system access or the ability to supply data to affected application programming interfaces (APIs) can exploit this vulnerability. Successful exploitation can result in unauthorized data access, allowing an attacker to read confidential information as well as modify or delete application data.

4.0 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-91382

A flaw was found in OpenJDK's 2D component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted data to an application that processes input using affected 2D APIs. Successful exploitation could allow the attacker to create, modify, or delete accessible data and cause a partial Denial of Service (DoS).

6.5 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
CWE-1286 - Improper Validation of Syntactic Correctness of Input
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-91394

A flaw was found in the OpenJDK Networking component. This vulnerability allows an unauthenticated remote attacker with network access to cause an information disclosure. By supplying crafted input to networking Application Programming Interfaces (APIs), such as through an exposed web service, an attacker could exploit this flaw to gain unauthorized access to critical data.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-524 - Use of Cache Containing Sensitive Information
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-91397

A flaw was found in OpenJDK's Serviceability component. An unauthenticated attacker with local access to the host system can exploit this vulnerability with user interaction, such as by supplying crafted input to Serviceability application programming interfaces (APIs). A successful attack can result in unauthorized modification or deletion of accessible data, as well as cause a partial Denial of Service (DoS).

3.6 (Low)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
CWE-488 - Exposure of Data Element to Wrong Session
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Low
CVE-2026-91398

A flaw was found in OpenJDK. An unauthenticated remote attacker with network access can exploit this vulnerability through the SOCKS5 (Socket Secure) networking protocol to compromise data integrity. Successful exploitation allows unauthorized creation, modification, or deletion of application data and can extend beyond the Java environment to impact related systems.

6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
CWE-358 - Improperly Implemented Security Check for Standard
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-91400

A flaw was found in the Sound component of Java SE and GraalVM. This issue allows an unauthenticated remote attacker to cause a partial Denial of Service (DoS) by convincing a user to run untrusted code within a sandboxed Java environment.

3.1 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Low
CVE-2026-91403

The certificate authority (CA) store used in OpenJDK and Oracle Java included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL Java client applications and cause such applications to connect to malicious sites.

6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Critical
CVE-2026-91410

A flaw was found in the Libraries component of OpenJDK. An unauthenticated remote attacker with network access can exploit this vulnerability by supplying crafted data to vulnerable application programming interfaces (APIs). Successful exploitation allows the attacker to cause a partial Denial of Service (DoS) of the application or service.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-91415

A flaw was found in OpenJDK's 2D component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to exposed application programming interfaces (APIs), such as through a web service or application that processes graphics data. A successful attack primarily allows an attacker to cause a Denial of Service (DoS) by triggering an application hang or crash, while also potentially permitting unauthorized reading or modification of a subset of accessible data.

4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-787 - Out-of-bounds Write
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Important
CVE-2026-91418

A flaw was found in OpenJDK's ImageIO component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to applications utilizing ImageIO APIs. Successful exploitation can result in a partial Denial of Service (DoS), degrading application availability.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-91451

A flaw was found in the Networking component of OpenJDK. This vulnerability allows an unauthenticated remote attacker to cause unauthorized data modification by sending crafted input to exposed Application Programming Interfaces (APIs), such as through web services. Successful exploitation enables an attacker to insert, update, or delete data accessible to the application.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-91452

A flaw was found in the Networking component of Oracle Java SE and GraalVM. An unauthenticated remote attacker can exploit this vulnerability by submitting crafted data across the network to exposed application programming interfaces (APIs), such as through a web service. A successful attack can allow an attacker to perform unauthorized modification, insertion, or deletion of accessible data.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-91453

A flaw was found in OpenJDK's Lightweight HTTP Server. An unauthenticated remote attacker can exploit this vulnerability over the network by sending crafted requests to exposed server Application Programming Interfaces (APIs). Successful exploitation allows an attacker to perform unauthorized data modifications, potentially inserting, altering, or deleting accessible application data.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-91461

A flaw was found in the Java Secure Socket Extension (JSSE) component. An unauthenticated remote attacker could exploit this vulnerability over Transport Layer Security (TLS) by sending crafted data to affected application programming interfaces (APIs). A successful attack allows the attacker to cause unauthorized modification, insertion, or deletion of accessible data.

3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-358 - Improperly Implemented Security Check for Standard
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Low
CVE-2026-91462

A flaw was found in the Java Generic Security Services (JGSS) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted requests to exposed application programming interfaces (APIs), such as through a web service. A successful attack allows the unauthorized creation, deletion, or modification of critical data accessible to the application.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-354 - Improper Validation of Integrity Check Value
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-91463

A flaw was found in the JGSS (Java Generic Security Services) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code in deployments relying on the Java sandbox. Successful exploitation can result in unauthorized access to sensitive data accessible to the Java environment.

5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CWE-749 - Exposed Dangerous Method or Function
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-91464

A flaw was found in OpenJDK's Java Generic Security Services (JGSS) component. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code within a sandboxed Java environment. Successful exploitation results in unauthorized information disclosure, allowing the attacker to access sensitive data accessible to the application.

5.3 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CWE-303 - Incorrect Implementation of Authentication Algorithm
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-91487

A flaw was found in the OpenJDK Compiler component. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted data to exposed application programming interfaces (APIs), such as through a web service. Successful exploitation could allow the attacker to read, update, or delete a subset of accessible data without authorization.

4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-1025 - Comparison Using Wrong Factors
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-101516

A flaw was found in the OpenJDK Libraries component. An unauthenticated remote attacker can exploit this vulnerability over a network by submitting crafted data to affected application programming interfaces (APIs), or through sandboxed environments that execute untrusted Java code. Successful exploitation allows the attacker to modify, insert, or delete accessible data, as well as gain unauthorized read access to sensitive information.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Moderate
CVE-2026-114820

The certificate authority (CA) store used in OpenJDK and Oracle Java included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL Java client applications and cause such applications to connect to malicious sites.

8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-295 - Improper Certificate Validation
Affected products
Fixed 1 product, the same list as for CVE-2026-83374
Threats
Impact Critical
References
URL Category
https://access.redhat.com/errata/RHSA-2026:88353 self
https://access.redhat.com/security/updates/classi… external
https://docs.redhat.com/en/documentation/red_hat_… external
https://bugzilla.redhat.com/show_bug.cgi?id=2556709 external
https://bugzilla.redhat.com/show_bug.cgi?id=2556795 external
https://bugzilla.redhat.com/show_bug.cgi?id=2556824 external
https://bugzilla.redhat.com/show_bug.cgi?id=2556837 external
https://bugzilla.redhat.com/show_bug.cgi?id=2556859 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557007 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557032 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557041 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557047 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557079 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557110 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557117 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557122 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557195 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557236 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557261 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557356 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557405 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557427 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557443 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557506 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557558 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557564 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557598 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557662 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557665 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557674 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557690 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557709 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557711 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557731 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557765 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557780 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557857 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557906 external
https://bugzilla.redhat.com/show_bug.cgi?id=2557956 external
https://bugzilla.redhat.com/show_bug.cgi?id=2558584 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-83374 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557765 external
https://www.cve.org/CVERecord?id=CVE-2026-83374 external
https://nvd.nist.gov/vuln/detail/CVE-2026-83374 external
https://www.oracle.com/security-alerts/cpuoct2026.html external
https://access.redhat.com/security/cve/CVE-2026-83376 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557427 external
https://www.cve.org/CVERecord?id=CVE-2026-83376 external
https://nvd.nist.gov/vuln/detail/CVE-2026-83376 external
https://access.redhat.com/security/cve/CVE-2026-83380 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557506 external
https://www.cve.org/CVERecord?id=CVE-2026-83380 external
https://nvd.nist.gov/vuln/detail/CVE-2026-83380 external
https://access.redhat.com/security/cve/CVE-2026-83381 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557032 external
https://www.cve.org/CVERecord?id=CVE-2026-83381 external
https://nvd.nist.gov/vuln/detail/CVE-2026-83381 external
https://access.redhat.com/security/cve/CVE-2026-83387 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557122 external
https://www.cve.org/CVERecord?id=CVE-2026-83387 external
https://nvd.nist.gov/vuln/detail/CVE-2026-83387 external
https://access.redhat.com/security/cve/CVE-2026-83395 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557110 external
https://www.cve.org/CVERecord?id=CVE-2026-83395 external
https://nvd.nist.gov/vuln/detail/CVE-2026-83395 external
https://access.redhat.com/security/cve/CVE-2026-83400 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557690 external
https://www.cve.org/CVERecord?id=CVE-2026-83400 external
https://nvd.nist.gov/vuln/detail/CVE-2026-83400 external
https://access.redhat.com/security/cve/CVE-2026-87290 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557731 external
https://www.cve.org/CVERecord?id=CVE-2026-87290 external
https://nvd.nist.gov/vuln/detail/CVE-2026-87290 external
https://access.redhat.com/security/cve/CVE-2026-87292 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557261 external
https://www.cve.org/CVERecord?id=CVE-2026-87292 external
https://nvd.nist.gov/vuln/detail/CVE-2026-87292 external
https://access.redhat.com/security/cve/CVE-2026-87294 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557906 external
https://www.cve.org/CVERecord?id=CVE-2026-87294 external
https://nvd.nist.gov/vuln/detail/CVE-2026-87294 external
https://access.redhat.com/security/cve/CVE-2026-87367 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557558 external
https://www.cve.org/CVERecord?id=CVE-2026-87367 external
https://nvd.nist.gov/vuln/detail/CVE-2026-87367 external
https://access.redhat.com/security/cve/CVE-2026-91332 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557041 external
https://www.cve.org/CVERecord?id=CVE-2026-91332 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91332 external
https://access.redhat.com/security/cve/CVE-2026-91334 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557662 external
https://www.cve.org/CVERecord?id=CVE-2026-91334 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91334 external
https://access.redhat.com/security/cve/CVE-2026-91335 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557598 external
https://www.cve.org/CVERecord?id=CVE-2026-91335 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91335 external
https://access.redhat.com/security/cve/CVE-2026-91373 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557356 external
https://www.cve.org/CVERecord?id=CVE-2026-91373 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91373 external
https://access.redhat.com/security/cve/CVE-2026-91374 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557564 external
https://www.cve.org/CVERecord?id=CVE-2026-91374 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91374 external
https://access.redhat.com/security/cve/CVE-2026-91375 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557857 external
https://www.cve.org/CVERecord?id=CVE-2026-91375 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91375 external
https://access.redhat.com/security/cve/CVE-2026-91379 self
https://bugzilla.redhat.com/show_bug.cgi?id=2556824 external
https://www.cve.org/CVERecord?id=CVE-2026-91379 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91379 external
https://access.redhat.com/security/cve/CVE-2026-91380 self
https://bugzilla.redhat.com/show_bug.cgi?id=2556859 external
https://www.cve.org/CVERecord?id=CVE-2026-91380 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91380 external
https://access.redhat.com/security/cve/CVE-2026-91382 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557665 external
https://www.cve.org/CVERecord?id=CVE-2026-91382 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91382 external
https://access.redhat.com/security/cve/CVE-2026-91394 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557956 external
https://www.cve.org/CVERecord?id=CVE-2026-91394 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91394 external
https://access.redhat.com/security/cve/CVE-2026-91397 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557007 external
https://www.cve.org/CVERecord?id=CVE-2026-91397 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91397 external
https://access.redhat.com/security/cve/CVE-2026-91398 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557711 external
https://www.cve.org/CVERecord?id=CVE-2026-91398 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91398 external
https://access.redhat.com/security/cve/CVE-2026-91400 self
https://bugzilla.redhat.com/show_bug.cgi?id=2556795 external
https://www.cve.org/CVERecord?id=CVE-2026-91400 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91400 external
https://access.redhat.com/security/cve/CVE-2026-91403 self
https://bugzilla.redhat.com/show_bug.cgi?id=2558584 external
https://www.cve.org/CVERecord?id=CVE-2026-91403 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91403 external
https://openjdk.org/groups/vulnerability/advisori… external
https://www.oracle.com/security-alerts/alert-cve-… external
https://access.redhat.com/security/cve/CVE-2026-91410 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557405 external
https://www.cve.org/CVERecord?id=CVE-2026-91410 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91410 external
https://access.redhat.com/security/cve/CVE-2026-91415 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557443 external
https://www.cve.org/CVERecord?id=CVE-2026-91415 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91415 external
https://access.redhat.com/security/cve/CVE-2026-91418 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557674 external
https://www.cve.org/CVERecord?id=CVE-2026-91418 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91418 external
https://access.redhat.com/security/cve/CVE-2026-91451 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557117 external
https://www.cve.org/CVERecord?id=CVE-2026-91451 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91451 external
https://access.redhat.com/security/cve/CVE-2026-91452 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557195 external
https://www.cve.org/CVERecord?id=CVE-2026-91452 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91452 external
https://access.redhat.com/security/cve/CVE-2026-91453 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557047 external
https://www.cve.org/CVERecord?id=CVE-2026-91453 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91453 external
https://access.redhat.com/security/cve/CVE-2026-91461 self
https://bugzilla.redhat.com/show_bug.cgi?id=2556837 external
https://www.cve.org/CVERecord?id=CVE-2026-91461 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91461 external
https://access.redhat.com/security/cve/CVE-2026-91462 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557236 external
https://www.cve.org/CVERecord?id=CVE-2026-91462 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91462 external
https://access.redhat.com/security/cve/CVE-2026-91463 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557780 external
https://www.cve.org/CVERecord?id=CVE-2026-91463 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91463 external
https://access.redhat.com/security/cve/CVE-2026-91464 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557709 external
https://www.cve.org/CVERecord?id=CVE-2026-91464 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91464 external
https://access.redhat.com/security/cve/CVE-2026-91487 self
https://bugzilla.redhat.com/show_bug.cgi?id=2556709 external
https://www.cve.org/CVERecord?id=CVE-2026-91487 external
https://nvd.nist.gov/vuln/detail/CVE-2026-91487 external
https://access.redhat.com/security/cve/CVE-2026-101516 self
https://bugzilla.redhat.com/show_bug.cgi?id=2557079 external
https://www.cve.org/CVERecord?id=CVE-2026-101516 external
https://nvd.nist.gov/vuln/detail/CVE-2026-101516 external
https://access.redhat.com/security/cve/CVE-2026-114820 self
https://bugzilla.redhat.com/show_bug.cgi?id=2560322 external
https://www.cve.org/CVERecord?id=CVE-2026-114820 external
https://nvd.nist.gov/vuln/detail/CVE-2026-114820 external
https://www.oracle.com/security-alerts/alert-cve-… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for OpenJDK.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The OpenJDK 17 packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.\n\nThis release of the Red Hat build of OpenJDK 17 (17.0.21) for portable Linux serves as a replacement for the Red Hat build of OpenJDK 17 (17.0.20 and 17.0.20.1) and includes security and bug fixes as well as enhancements. For further information, refer to the release notes linked to in the References section.\n\nSecurity Fix(es):\n\n* JDK: Enhance PKCS5 padding (CVE-2026-83374)\n\n* JDK: Enhance TLS certificate handling (CVE-2026-83376)\n\n* JDK: Enhance LDAP logins (CVE-2026-83380)\n\n* JDK: Enhance SASL Authentication (CVE-2026-83381)\n\n* JDK: Enhance WebRowSets (CVE-2026-83387)\n\n* JDK: Enhance HTTP Client Response Handling (CVE-2026-83395)\n\n* JDK: Enhance XML Processing (CVE-2026-83400)\n\n* JDK: Enhance XPath Expressions (CVE-2026-87290)\n\n* JDK: Enhance Network Clients (CVE-2026-87292)\n\n* JDK: Enhance Certificate Name Checks (CVE-2026-87294)\n\n* JDK: Enhance Template Handling (CVE-2026-87367)\n\n* JDK: Enhance HTTP Client (CVE-2026-91332)\n\n* JDK: Enhance JPEG loading (CVE-2026-91334)\n\n* JDK: Enhance Image Handling (CVE-2026-91335)\n\n* JDK: Enhance TLS handshakes (CVE-2026-91373)\n\n* JDK: Enhance jstatd (CVE-2026-91374)\n\n* JDK: Enhance jmod handling (CVE-2026-91375)\n\n* JDK: Enhance JShell (CVE-2026-91379)\n\n* JDK: Enhance Preferences (CVE-2026-91380)\n\n* JDK: Enhance Image Processing (CVE-2026-91382)\n\n* JDK: Enhance HTTP client caching (CVE-2026-91394)\n\n* JDK: Enhance diagnostic sessions (CVE-2026-91397)\n\n* JDK: Enhance SOCKS5 support (CVE-2026-91398)\n\n* JDK: Enhance MIDI file handling (CVE-2026-91400)\n\n* JDK: Enhance zipfs (CVE-2026-91410)\n\n* JDK: Enhance font rendering (CVE-2026-91415)\n\n* JDK: Enhance GIF loading (CVE-2026-91418)\n\n* JDK: Enhance HTTP server parsing (CVE-2026-91451)\n\n* JDK: Enhance HTTP server (CVE-2026-91452)\n\n* JDK: Improve HTTP headers (CVE-2026-91453)\n\n* JDK: Enhance TLS Extensions (CVE-2026-91461)\n\n* JDK: Enhance krb5 tokens (CVE-2026-91462)\n\n* JDK: Enhance krb5 client (CVE-2026-91463)\n\n* JDK: Enhance Kerberos validation (CVE-2026-91464)\n\n* JDK: Enhance C2 comparisons (CVE-2026-91487)\n\n* JDK: Enhance Certificate Constraint Checking (CVE-2026-101516)\n\n* JDK: Enhance Image Processing (CVE-2026-91382)\n\n* JDK: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-91403)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:88353",
        "url": "https://access.redhat.com/errata/RHSA-2026:88353"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_build_of_openjdk/17/html/release_notes_for_red_hat_build_of_openjdk_17.0.21/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_build_of_openjdk/17/html/release_notes_for_red_hat_build_of_openjdk_17.0.21/index"
      },
      {
        "category": "external",
        "summary": "2556709",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556709"
      },
      {
        "category": "external",
        "summary": "2556795",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556795"
      },
      {
        "category": "external",
        "summary": "2556824",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556824"
      },
      {
        "category": "external",
        "summary": "2556837",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556837"
      },
      {
        "category": "external",
        "summary": "2556859",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556859"
      },
      {
        "category": "external",
        "summary": "2557007",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557007"
      },
      {
        "category": "external",
        "summary": "2557032",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557032"
      },
      {
        "category": "external",
        "summary": "2557041",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557041"
      },
      {
        "category": "external",
        "summary": "2557047",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557047"
      },
      {
        "category": "external",
        "summary": "2557079",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557079"
      },
      {
        "category": "external",
        "summary": "2557110",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557110"
      },
      {
        "category": "external",
        "summary": "2557117",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557117"
      },
      {
        "category": "external",
        "summary": "2557122",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557122"
      },
      {
        "category": "external",
        "summary": "2557195",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557195"
      },
      {
        "category": "external",
        "summary": "2557236",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557236"
      },
      {
        "category": "external",
        "summary": "2557261",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557261"
      },
      {
        "category": "external",
        "summary": "2557356",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557356"
      },
      {
        "category": "external",
        "summary": "2557405",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557405"
      },
      {
        "category": "external",
        "summary": "2557427",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557427"
      },
      {
        "category": "external",
        "summary": "2557443",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557443"
      },
      {
        "category": "external",
        "summary": "2557506",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557506"
      },
      {
        "category": "external",
        "summary": "2557558",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557558"
      },
      {
        "category": "external",
        "summary": "2557564",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557564"
      },
      {
        "category": "external",
        "summary": "2557598",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557598"
      },
      {
        "category": "external",
        "summary": "2557662",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557662"
      },
      {
        "category": "external",
        "summary": "2557665",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557665"
      },
      {
        "category": "external",
        "summary": "2557674",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557674"
      },
      {
        "category": "external",
        "summary": "2557690",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557690"
      },
      {
        "category": "external",
        "summary": "2557709",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557709"
      },
      {
        "category": "external",
        "summary": "2557711",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557711"
      },
      {
        "category": "external",
        "summary": "2557731",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557731"
      },
      {
        "category": "external",
        "summary": "2557765",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557765"
      },
      {
        "category": "external",
        "summary": "2557780",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557780"
      },
      {
        "category": "external",
        "summary": "2557857",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557857"
      },
      {
        "category": "external",
        "summary": "2557906",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557906"
      },
      {
        "category": "external",
        "summary": "2557956",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557956"
      },
      {
        "category": "external",
        "summary": "2558584",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558584"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_88353.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenJDK 17.0.21 Security Update for Portable Linux Builds",
    "tracking": {
      "current_release_date": "2026-10-29T13:02:06+00:00",
      "generator": {
        "date": "2026-10-29T13:02:06+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.3"
        }
      },
      "id": "RHSA-2026:88353",
      "initial_release_date": "2026-10-27T19:53:15+00:00",
      "revision_history": [
        {
          "date": "2026-10-27T19:53:15+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-27T19:53:15+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-29T13:02:06+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Build of OpenJDK 17.0.21",
                "product": {
                  "name": "Red Hat Build of OpenJDK 17.0.21",
                  "product_id": "Red Hat Build of OpenJDK 17.0.21",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openjdk:17"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "OpenJDK"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-83374",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2026-10-21T00:27:57.766140+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557765"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by sending crafted requests across network protocols to exposed application programming interfaces (APIs) within the Security component. A successful attack can result in unauthorized modification, creation, or deletion of critical application data. In addition, the flaw may allow untrusted code running in a restricted sandbox environment to tamper with protected data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-83374"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557765",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557765"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-83374",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-83374"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83374",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83374"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:23:36.480000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-83376",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-21T00:06:18.567183+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557427"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java Secure Socket Extension (JSSE) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability over a Transport Layer Security (TLS) connection to perform unauthorized modification, insertion, or deletion of accessible data. Exploitation occurs when network services or applications process untrusted network input through affected JSSE APIs, compromising data integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-83376"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557427",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557427"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-83376",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-83376"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83376",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83376"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:23:37.211000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-83380",
      "cwe": {
        "id": "CWE-90",
        "name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
      },
      "discovery_date": "2026-10-21T00:12:11.889139+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557506"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK within the Java Authentication and Authorization Service (JAAS) component. An unauthenticated remote attacker can exploit this vulnerability over a network by sending data to affected application programming interfaces (APIs). Successful exploitation results in information disclosure, granting unauthorized read access to a subset of accessible data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance LDAP logins (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-83380"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557506",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557506"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-83380",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-83380"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83380",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83380"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:23:38.688000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance LDAP logins (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-83381",
      "cwe": {
        "id": "CWE-303",
        "name": "Incorrect Implementation of Authentication Algorithm"
      },
      "discovery_date": "2026-10-20T23:03:15.841868+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557032"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK. An unauthenticated remote attacker can exploit this vulnerability over a network by supplying crafted input to Application Programming Interfaces (APIs) within the Security component. Successful exploitation can result in unauthorized read and modification access to a subset of data accessible to the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance SASL Authentication (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-83381"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557032",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557032"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-83381",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-83381"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83381",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83381"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:23:39.066000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance SASL Authentication (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-83387",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2026-10-20T23:12:29.943042+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557122"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java Database Connectivity (JDBC) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to exposed JDBC application programming interfaces (APIs) or by executing untrusted code. If successfully exploited, this flaw allows an attacker to obtain unauthorized access to critical data, leading to information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance WebRowSets (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-83387"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557122",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557122"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-83387",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-83387"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83387",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83387"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:23:41.652000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance WebRowSets (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-83395",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-10-20T23:11:11.725999+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557110"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK. An unauthenticated remote attacker with network access could exploit this vulnerability by submitting crafted data to networking application programming interfaces (APIs). A successful attack could allow unauthorized modification or deletion of accessible data, or result in a partial Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-83395"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557110",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557110"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-83395",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-83395"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83395",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83395"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:23:44.691000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-83400",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-10-21T00:23:52.318710+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557690"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java API for XML Processing (JAXP) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting crafted data across the network to applications that expose JAXP interfaces, such as through a web service. Successful exploitation can result in a partial Denial of Service (DoS), reducing the availability of the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance XML Processing (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-83400"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557690",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557690"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-83400",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-83400"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83400",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83400"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:23:46.645000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance XML Processing (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-87290",
      "cwe": {
        "id": "CWE-91",
        "name": "XML Injection (aka Blind XPath Injection)"
      },
      "discovery_date": "2026-10-21T00:26:09.025376+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557731"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java API for XML Processing (JAXP) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to applications or web services that rely on vulnerable JAXP APIs. Successful exploitation can result in unauthorized information disclosure, allowing an attacker to access sensitive data managed by the Java application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance XPath Expressions (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-87290"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557731",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557731"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-87290",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-87290"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87290",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87290"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:23:51.453000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance XPath Expressions (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-87292",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
      },
      "discovery_date": "2026-10-20T23:53:30.411856+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557261"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OpenJDK networking component. This vulnerability may allow an unauthenticated remote attacker to cause unauthorized data modification. By supplying crafted input to exposed networking application programming interfaces (APIs), such as through a web service, an attacker can insert, update, or delete a subset of accessible data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance Network Clients (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-87292"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557261",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557261"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-87292",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-87292"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87292",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87292"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:23:52.207000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openjdk: Enhance Network Clients (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-87294",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-21T00:36:03.345990+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557906"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK. An unauthenticated remote attacker can exploit this issue across multiple network protocols by submitting crafted requests to application programming interfaces (APIs) within the Security component. Successful exploitation allows an attacker to modify or delete accessible application data, as well as gain unauthorized read access to sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-87294"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557906",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557906"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-87294",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-87294"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87294",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87294"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:23:52.938000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-87367",
      "cwe": {
        "id": "CWE-91",
        "name": "XML Injection (aka Blind XPath Injection)"
      },
      "discovery_date": "2026-10-21T00:16:13.349275+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557558"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the JAXP (Java API for XML Processing) component of OpenJDK. An unauthenticated remote attacker can exploit this vulnerability by providing crafted input to applications or web services that process data through JAXP APIs. Successful exploitation allows the attacker to perform unauthorized data modifications, including updating, inserting, or deleting accessible data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance Template Handling (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-87367"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557558",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557558"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-87367",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-87367"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87367",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87367"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:24:19.687000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openjdk: Enhance Template Handling (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91332",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-10-20T23:04:12.620420+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557041"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s Networking component. An unauthenticated remote attacker with network access can exploit this vulnerability by sending crafted input to exposed networking Application Programming Interfaces (APIs). Successful exploitation allows the attacker to perform unauthorized data modifications, potentially inserting, altering, or deleting accessible application data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance HTTP Client (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91332"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557041",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557041"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91332",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91332"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91332",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91332"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:21.977000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance HTTP Client (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91334",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-10-21T00:22:15.799669+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557662"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s ImageIO component. This vulnerability allows an unauthenticated remote attacker to cause information disclosure by submitting crafted inputs to applications or web services using the ImageIO application programming interface (API). Successful exploitation can result in unauthorized read access to a subset of accessible data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance JPEG loading (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91334"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557662",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557662"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91334",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91334"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91334",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91334"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:22.651000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openjdk: Enhance JPEG loading (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91335",
      "cwe": {
        "id": "CWE-653",
        "name": "Improper Isolation or Compartmentalization"
      },
      "discovery_date": "2026-10-21T00:18:28.666628+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557598"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s Abstract Window Toolkit (AWT). A remote attacker with low privileges could exploit this vulnerability by convincing a user to run untrusted code within a sandboxed environment. Successful exploitation allows unauthorized read access to a subset of accessible data, leading to information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance Image Handling (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91335"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557598",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557598"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91335",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91335"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91335",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91335"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:22.996000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openjdk: Enhance Image Handling (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91373",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-21T00:01:44.146025+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557356"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s Java Secure Socket Extension (JSSE) component. An unauthenticated remote attacker with network access via Transport Layer Security (TLS) can exploit this vulnerability to cause a partial Denial of Service (DoS). This issue can be triggered when an application or web service processes untrusted network data using the affected JSSE APIs.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance TLS handshakes (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91373"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557356",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557356"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91373",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91373"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91373",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91373"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:36.496000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance TLS handshakes (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91374",
      "cwe": {
        "id": "CWE-749",
        "name": "Exposed Dangerous Method or Function"
      },
      "discovery_date": "2026-10-21T00:16:49.118613+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557564"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Serviceability component of OpenJDK. An unauthenticated remote attacker can exploit this issue across the network by supplying crafted data to exposed application programming interfaces (APIs) or by running untrusted code within a sandboxed Java environment. Successful exploitation may lead to unauthorized data access, allowing the attacker to read and modify sensitive application data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance jstatd (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91374"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557564",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557564"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91374",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91374"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91374",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91374"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:36.857000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance jstatd (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91375",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-10-21T00:33:06.264015+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557857"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in openjdk. An unauthenticated attacker with local access to the host system could leverage this vulnerability in the Libraries component by convincing a user to interact with a malicious application or by supplying crafted input through exposed application programming interfaces (APIs). Successful exploitation allows the attacker to compromise data integrity, resulting in the unauthorized modification, creation, or deletion of critical data accessible to the Java runtime environment.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance jmod handling (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91375"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557857",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557857"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91375",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91375"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91375",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91375"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:37.216000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance jmod handling (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91379",
      "cwe": {
        "id": "CWE-653",
        "name": "Improper Isolation or Compartmentalization"
      },
      "discovery_date": "2026-10-20T22:45:57.814362+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556824"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s JDK tools component. An unauthenticated local attacker can exploit this vulnerability by convincing a user to interact with untrusted code in an environment relying on the Java security sandbox. A successful attack can result in unauthorized creation, modification, or deletion of critical data accessible to the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance JShell (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91379"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556824",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556824"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91379",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91379"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91379",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91379"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:38.600000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance JShell (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91380",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-10-20T22:48:13.943380+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556859"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OpenJDK Utility component. An unauthenticated attacker with local system access or the ability to supply data to affected application programming interfaces (APIs) can exploit this vulnerability. Successful exploitation can result in unauthorized data access, allowing an attacker to read confidential information as well as modify or delete application data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance Preferences (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91380"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556859",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556859"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91380",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91380"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91380",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91380"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:38.943000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance Preferences (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91382",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-10-21T00:22:23.378283+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557665"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s 2D component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted data to an application that processes input using affected 2D APIs. Successful exploitation could allow the attacker to create, modify, or delete accessible data and cause a partial Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance Image Processing (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91382"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557665",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557665"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91382",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91382"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91382",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91382"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:39.637000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance Image Processing (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91394",
      "cwe": {
        "id": "CWE-524",
        "name": "Use of Cache Containing Sensitive Information"
      },
      "discovery_date": "2026-10-21T00:41:14.425071+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557956"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OpenJDK Networking component. This vulnerability allows an unauthenticated remote attacker with network access to cause an information disclosure. By supplying crafted input to networking Application Programming Interfaces (APIs), such as through an exposed web service, an attacker could exploit this flaw to gain unauthorized access to critical data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance HTTP client caching (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91394"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557956",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557956"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91394",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91394"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91394",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91394"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:44.100000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance HTTP client caching (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91397",
      "cwe": {
        "id": "CWE-488",
        "name": "Exposure of Data Element to Wrong Session"
      },
      "discovery_date": "2026-10-20T22:59:49.519270+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557007"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s Serviceability component. An unauthenticated attacker with local access to the host system can exploit this vulnerability with user interaction, such as by supplying crafted input to Serviceability application programming interfaces (APIs). A successful attack can result in unauthorized modification or deletion of accessible data, as well as cause a partial Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91397"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557007",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557007"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91397",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91397"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91397",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91397"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:45.159000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91398",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2026-10-21T00:24:59.058513+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557711"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK. An unauthenticated remote attacker with network access can exploit this vulnerability through the SOCKS5 (Socket Secure) networking protocol to compromise data integrity. Successful exploitation allows unauthorized creation, modification, or deletion of application data and can extend beyond the Java environment to impact related systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91398"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557711",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557711"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91398",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91398"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91398",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91398"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:45.513000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91400",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-20T22:35:48.178085+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556795"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Sound component of Java SE and GraalVM. This issue allows an unauthenticated remote attacker to cause a partial Denial of Service (DoS) by convincing a user to run untrusted code within a sandboxed Java environment.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91400"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556795",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556795"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91400",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91400"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91400",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91400"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:46.374000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91403",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-21T21:44:33.921248+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2558584"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The certificate authority (CA) store used in OpenJDK and Oracle Java included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL Java client applications and cause such applications to connect to malicious sites.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The non-portable OpenJDK RPM packages in Red Hat Enterprise Linux rely on ca-certificates packages for their default certificate store. Therefore, those OpenJDK versions require updated ca-certificates RPM package to be installed to address this issue (refer to CVE-2026-114406 for more details).\n\nThe portable OpenJDK builds for both Linux and Windows include their own certificate store and therefore need to be updated separately from the ca-certificates updates.\n\nThe certificate bundle in OpenJDK upstream included root certificates, which signed eMudhra certificates with weak keys. Upstream OpenJDK fix did not initially remove those root certificates, but rather only blocked problematic intermediate certificates. However, this fix was found to be insufficient and OpenJDK upstream later removed relevant root CA certificates, see CVE-2026-114820.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91403"
        },
        {
          "category": "external",
          "summary": "RHBZ#2558584",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558584"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91403",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91403"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91403",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91403"
        },
        {
          "category": "external",
          "summary": "https://openjdk.org/groups/vulnerability/advisories/2026-10-21",
          "url": "https://openjdk.org/groups/vulnerability/advisories/2026-10-21"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/alert-cve-2026-91403.html",
          "url": "https://www.oracle.com/security-alerts/alert-cve-2026-91403.html"
        }
      ],
      "release_date": "2026-10-21T21:23:28.057000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns"
    },
    {
      "cve": "CVE-2026-91410",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-10-21T00:04:49.787811+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557405"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Libraries component of OpenJDK. An unauthenticated remote attacker with network access can exploit this vulnerability by supplying crafted data to vulnerable application programming interfaces (APIs). Successful exploitation allows the attacker to cause a partial Denial of Service (DoS) of the application or service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance zipfs (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91410"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557405",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557405"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91410",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91410"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91410",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91410"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:49.138000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance zipfs (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91415",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-10-21T00:07:18.992619+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557443"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s 2D component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to exposed application programming interfaces (APIs), such as through a web service or application that processes graphics data. A successful attack primarily allows an attacker to cause a Denial of Service (DoS) by triggering an application hang or crash, while also potentially permitting unauthorized reading or modification of a subset of accessible data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance font rendering (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91415"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557443",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557443"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91415",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91415"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91415",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91415"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:50.975000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openjdk: Enhance font rendering (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91418",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-10-21T00:22:57.705155+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557674"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s ImageIO component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to applications utilizing ImageIO APIs. Successful exploitation can result in a partial Denial of Service (DoS), degrading application availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance GIF loading (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91418"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557674",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557674"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91418"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91418",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91418"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:51.705000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance GIF loading (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91451",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-10-20T23:11:58.335143+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557117"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Networking component of OpenJDK. This vulnerability allows an unauthenticated remote attacker to cause unauthorized data modification by sending crafted input to exposed Application Programming Interfaces (APIs), such as through web services. Successful exploitation enables an attacker to insert, update, or delete data accessible to the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91451"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557117",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557117"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91451",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91451"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91451",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91451"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:26:02.855000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91452",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-10-20T23:44:29.335406+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557195"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Networking component of Oracle Java SE and GraalVM. An unauthenticated remote attacker can exploit this vulnerability by submitting crafted data across the network to exposed application programming interfaces (APIs), such as through a web service. A successful attack can allow an attacker to perform unauthorized modification, insertion, or deletion of accessible data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance HTTP server (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91452"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557195",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557195"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91452",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91452"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91452",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91452"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:26:03.214000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance HTTP server (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91453",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-10-20T23:04:57.893720+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557047"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s Lightweight HTTP Server. An unauthenticated remote attacker can exploit this vulnerability over the network by sending crafted requests to exposed server Application Programming Interfaces (APIs). Successful exploitation allows an attacker to perform unauthorized data modifications, potentially inserting, altering, or deleting accessible application data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Improve HTTP headers (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91453"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557047",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557047"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91453",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91453"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91453",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91453"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:26:03.566000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Improve HTTP headers (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91461",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2026-10-20T22:46:53.031979+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556837"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java Secure Socket Extension (JSSE) component. An unauthenticated remote attacker could exploit this vulnerability over Transport Layer Security (TLS) by sending crafted data to affected application programming interfaces (APIs). A successful attack allows the attacker to cause unauthorized modification, insertion, or deletion of accessible data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance TLS Extensions (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91461"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556837",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556837"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91461",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91461"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91461",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91461"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:26:05.674000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openjdk: Enhance TLS Extensions (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91462",
      "cwe": {
        "id": "CWE-354",
        "name": "Improper Validation of Integrity Check Value"
      },
      "discovery_date": "2026-10-20T23:49:52.141916+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557236"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java Generic Security Services (JGSS) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted requests to exposed application programming interfaces (APIs), such as through a web service. A successful attack allows the unauthorized creation, deletion, or modification of critical data accessible to the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance krb5 tokens (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91462"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557236",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557236"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91462",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91462"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91462",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91462"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:26:06.021000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance krb5 tokens (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91463",
      "cwe": {
        "id": "CWE-749",
        "name": "Exposed Dangerous Method or Function"
      },
      "discovery_date": "2026-10-21T00:28:48.205982+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557780"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the JGSS (Java Generic Security Services) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code in deployments relying on the Java sandbox. Successful exploitation can result in unauthorized access to sensitive data accessible to the Java environment.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance krb5 client (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91463"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557780",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557780"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91463",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91463"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91463",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91463"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:26:06.372000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance krb5 client (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91464",
      "cwe": {
        "id": "CWE-303",
        "name": "Incorrect Implementation of Authentication Algorithm"
      },
      "discovery_date": "2026-10-21T00:24:53.048347+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557709"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s Java Generic Security Services (JGSS) component. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code within a sandboxed Java environment. Successful exploitation results in unauthorized information disclosure, allowing the attacker to access sensitive data accessible to the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance Kerberos validation (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91464"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557709",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557709"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91464",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91464"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91464",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91464"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:26:06.710000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance Kerberos validation (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91487",
      "cwe": {
        "id": "CWE-1025",
        "name": "Comparison Using Wrong Factors"
      },
      "discovery_date": "2026-10-20T22:23:21.307778+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556709"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OpenJDK Compiler component. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted data to exposed application programming interfaces (APIs), such as through a web service. Successful exploitation could allow the attacker to read, update, or delete a subset of accessible data without authorization.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance C2 comparisons (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91487"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556709",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556709"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91487",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91487"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91487",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91487"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:26:13.608000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance C2 comparisons (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-101516",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-20T23:08:33.332965+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557079"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OpenJDK Libraries component. An unauthenticated remote attacker can exploit this vulnerability over a network by submitting crafted data to affected application programming interfaces (APIs), or through sandboxed environments that execute untrusted Java code. Successful exploitation allows the attacker to modify, insert, or delete accessible data, as well as gain unauthorized read access to sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-101516"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557079",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557079"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-101516",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-101516"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-101516",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101516"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:21:18.319000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-114820",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-24T18:50:57.271768+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2560322"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The certificate authority (CA) store used in OpenJDK and Oracle Java included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL Java client applications and cause such applications to connect to malicious sites.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The non-portable OpenJDK RPM packages in Red Hat Enterprise Linux rely on ca-certificates packages for their default certificate store. Therefore, those OpenJDK versions require updated ca-certificates RPM package to be installed to address this issue (refer to CVE-2026-114406 for more details).\n\nThe portable OpenJDK builds for both Linux and Windows include their own certificate store and therefore neeed to be updated separately from the ca-certificates updates.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-114820"
        },
        {
          "category": "external",
          "summary": "RHBZ#2560322",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560322"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-114820",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-114820"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114820",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114820"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/alert-cve-2026-114820.html",
          "url": "https://www.oracle.com/security-alerts/alert-cve-2026-114820.html"
        }
      ],
      "release_date": "2026-10-24T18:42:04.571000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.