{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for OpenJDK.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The OpenJDK 17 packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.\n\nThis release of the Red Hat build of OpenJDK 17 (17.0.21) for portable Linux serves as a replacement for the Red Hat build of OpenJDK 17 (17.0.20 and 17.0.20.1) and includes security and bug fixes as well as enhancements. For further information, refer to the release notes linked to in the References section.\n\nSecurity Fix(es):\n\n* JDK: Enhance PKCS5 padding (CVE-2026-83374)\n\n* JDK: Enhance TLS certificate handling (CVE-2026-83376)\n\n* JDK: Enhance LDAP logins (CVE-2026-83380)\n\n* JDK: Enhance SASL Authentication (CVE-2026-83381)\n\n* JDK: Enhance WebRowSets (CVE-2026-83387)\n\n* JDK: Enhance HTTP Client Response Handling (CVE-2026-83395)\n\n* JDK: Enhance XML Processing (CVE-2026-83400)\n\n* JDK: Enhance XPath Expressions (CVE-2026-87290)\n\n* JDK: Enhance Network Clients (CVE-2026-87292)\n\n* JDK: Enhance Certificate Name Checks (CVE-2026-87294)\n\n* JDK: Enhance Template Handling (CVE-2026-87367)\n\n* JDK: Enhance HTTP Client (CVE-2026-91332)\n\n* JDK: Enhance JPEG loading (CVE-2026-91334)\n\n* JDK: Enhance Image Handling (CVE-2026-91335)\n\n* JDK: Enhance TLS handshakes (CVE-2026-91373)\n\n* JDK: Enhance jstatd (CVE-2026-91374)\n\n* JDK: Enhance jmod handling (CVE-2026-91375)\n\n* JDK: Enhance JShell (CVE-2026-91379)\n\n* JDK: Enhance Preferences (CVE-2026-91380)\n\n* JDK: Enhance Image Processing (CVE-2026-91382)\n\n* JDK: Enhance HTTP client caching (CVE-2026-91394)\n\n* JDK: Enhance diagnostic sessions (CVE-2026-91397)\n\n* JDK: Enhance SOCKS5 support (CVE-2026-91398)\n\n* JDK: Enhance MIDI file handling (CVE-2026-91400)\n\n* JDK: Enhance zipfs (CVE-2026-91410)\n\n* JDK: Enhance font rendering (CVE-2026-91415)\n\n* JDK: Enhance GIF loading (CVE-2026-91418)\n\n* JDK: Enhance HTTP server parsing (CVE-2026-91451)\n\n* JDK: Enhance HTTP server (CVE-2026-91452)\n\n* JDK: Improve HTTP headers (CVE-2026-91453)\n\n* JDK: Enhance TLS Extensions (CVE-2026-91461)\n\n* JDK: Enhance krb5 tokens (CVE-2026-91462)\n\n* JDK: Enhance krb5 client (CVE-2026-91463)\n\n* JDK: Enhance Kerberos validation (CVE-2026-91464)\n\n* JDK: Enhance C2 comparisons (CVE-2026-91487)\n\n* JDK: Enhance Certificate Constraint Checking (CVE-2026-101516)\n\n* JDK: Enhance Image Processing (CVE-2026-91382)\n\n* JDK: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-91403)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:88353",
        "url": "https://access.redhat.com/errata/RHSA-2026:88353"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_build_of_openjdk/17/html/release_notes_for_red_hat_build_of_openjdk_17.0.21/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_build_of_openjdk/17/html/release_notes_for_red_hat_build_of_openjdk_17.0.21/index"
      },
      {
        "category": "external",
        "summary": "2556709",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556709"
      },
      {
        "category": "external",
        "summary": "2556795",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556795"
      },
      {
        "category": "external",
        "summary": "2556824",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556824"
      },
      {
        "category": "external",
        "summary": "2556837",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556837"
      },
      {
        "category": "external",
        "summary": "2556859",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556859"
      },
      {
        "category": "external",
        "summary": "2557007",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557007"
      },
      {
        "category": "external",
        "summary": "2557032",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557032"
      },
      {
        "category": "external",
        "summary": "2557041",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557041"
      },
      {
        "category": "external",
        "summary": "2557047",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557047"
      },
      {
        "category": "external",
        "summary": "2557079",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557079"
      },
      {
        "category": "external",
        "summary": "2557110",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557110"
      },
      {
        "category": "external",
        "summary": "2557117",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557117"
      },
      {
        "category": "external",
        "summary": "2557122",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557122"
      },
      {
        "category": "external",
        "summary": "2557195",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557195"
      },
      {
        "category": "external",
        "summary": "2557236",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557236"
      },
      {
        "category": "external",
        "summary": "2557261",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557261"
      },
      {
        "category": "external",
        "summary": "2557356",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557356"
      },
      {
        "category": "external",
        "summary": "2557405",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557405"
      },
      {
        "category": "external",
        "summary": "2557427",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557427"
      },
      {
        "category": "external",
        "summary": "2557443",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557443"
      },
      {
        "category": "external",
        "summary": "2557506",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557506"
      },
      {
        "category": "external",
        "summary": "2557558",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557558"
      },
      {
        "category": "external",
        "summary": "2557564",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557564"
      },
      {
        "category": "external",
        "summary": "2557598",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557598"
      },
      {
        "category": "external",
        "summary": "2557662",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557662"
      },
      {
        "category": "external",
        "summary": "2557665",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557665"
      },
      {
        "category": "external",
        "summary": "2557674",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557674"
      },
      {
        "category": "external",
        "summary": "2557690",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557690"
      },
      {
        "category": "external",
        "summary": "2557709",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557709"
      },
      {
        "category": "external",
        "summary": "2557711",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557711"
      },
      {
        "category": "external",
        "summary": "2557731",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557731"
      },
      {
        "category": "external",
        "summary": "2557765",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557765"
      },
      {
        "category": "external",
        "summary": "2557780",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557780"
      },
      {
        "category": "external",
        "summary": "2557857",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557857"
      },
      {
        "category": "external",
        "summary": "2557906",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557906"
      },
      {
        "category": "external",
        "summary": "2557956",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557956"
      },
      {
        "category": "external",
        "summary": "2558584",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558584"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_88353.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenJDK 17.0.21 Security Update for Portable Linux Builds",
    "tracking": {
      "current_release_date": "2026-10-29T21:56:38+00:00",
      "generator": {
        "date": "2026-10-29T21:56:38+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.3"
        }
      },
      "id": "RHSA-2026:88353",
      "initial_release_date": "2026-10-27T19:53:15+00:00",
      "revision_history": [
        {
          "date": "2026-10-27T19:53:15+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-27T19:53:15+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-29T21:56:38+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Build of OpenJDK 17.0.21",
                "product": {
                  "name": "Red Hat Build of OpenJDK 17.0.21",
                  "product_id": "Red Hat Build of OpenJDK 17.0.21",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openjdk:17"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "OpenJDK"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-83374",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2026-10-21T00:27:57.766140+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557765"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by sending crafted requests across network protocols to exposed application programming interfaces (APIs) within the Security component. A successful attack can result in unauthorized modification, creation, or deletion of critical application data. In addition, the flaw may allow untrusted code running in a restricted sandbox environment to tamper with protected data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate impact because exploitation carries high complexity, requiring targeted conditions where an application exposes PKCS#5 cryptographic padding routines directly to unauthenticated network input. In typical Red Hat Enterprise Linux and container deployments, Java applications do not process raw cipher data from untrusted clients without intermediate validation layers or authentication. Furthermore, the scope is limited to data integrity without compromising confidentiality or causing service denial.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-83374"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557765",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557765"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-83374",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-83374"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83374",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83374"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:23:36.480000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-83376",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-21T00:06:18.567183+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557427"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java Secure Socket Extension (JSSE) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability over a Transport Layer Security (TLS) connection to perform unauthorized modification, insertion, or deletion of accessible data. Exploitation occurs when network services or applications process untrusted network input through affected JSSE APIs, compromising data integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having a Low impact because exploitation requires complex conditions during TLS negotiation and results only in partial integrity compromise, with no loss of confidentiality or system availability. In typical Red Hat Enterprise Linux and OpenJDK deployments, TLS connections utilize standard certificate validation pipelines and trust stores, preventing straightforward or broad exploitation. Consequently, the operational risk in standard environments is minimal.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-83376"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557427",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557427"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-83376",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-83376"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83376",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83376"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:23:37.211000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-83380",
      "cwe": {
        "id": "CWE-90",
        "name": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)"
      },
      "discovery_date": "2026-10-21T00:12:11.889139+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557506"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK within the Java Authentication and Authorization Service (JAAS) component. An unauthenticated remote attacker can exploit this vulnerability over a network by sending data to affected application programming interfaces (APIs). Successful exploitation results in information disclosure, granting unauthorized read access to a subset of accessible data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance LDAP logins (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate because exploitation is limited to partial information disclosure without compromising system integrity or service availability. For Red Hat environments, exposure is restricted to applications that accept external user inputs and process them through the OpenJDK JAAS LDAP authentication modules. Workloads that do not utilize JAAS for directory service logins or that sanitize input prior to authentication calls are not exposed to this risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-83380"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557506",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557506"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-83380",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-83380"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83380",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83380"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:23:38.688000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance LDAP logins (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-83381",
      "cwe": {
        "id": "CWE-303",
        "name": "Incorrect Implementation of Authentication Algorithm"
      },
      "discovery_date": "2026-10-20T23:03:15.841868+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557032"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK. An unauthenticated remote attacker can exploit this vulnerability over a network by supplying crafted input to Application Programming Interfaces (APIs) within the Security component. Successful exploitation can result in unauthorized read and modification access to a subset of data accessible to the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance SASL Authentication (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having a Moderate impact because exploitation demands high complexity, requiring an attacker to target applications that expose specific SASL authentication endpoints or process untrusted authentication exchange data. In standard Red Hat Enterprise Linux server environments, Java services do not inherently expose vulnerable interfaces unless custom applications explicitly invoke the affected Security subsystem APIs. Exploitation cannot achieve full system takeover or complete service denial, restricting the potential consequence to unauthorized read or modification of a limited subset of application data.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-83381"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557032",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557032"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-83381",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-83381"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83381",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83381"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:23:39.066000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance SASL Authentication (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-83387",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2026-10-20T23:12:29.943042+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557122"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java Database Connectivity (JDBC) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to exposed JDBC application programming interfaces (APIs) or by executing untrusted code. If successfully exploited, this flaw allows an attacker to obtain unauthorized access to critical data, leading to information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance WebRowSets (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat rates this vulnerability as Moderate because exploitation requires an application to parse untrusted input using specific JDBC WebRowSet XML interfaces or execute untrusted code in a sandboxed environment. In typical enterprise architectures, these specialized APIs are not directly accessible to external, unauthenticated users. Additionally, the flaw is restricted to unauthorized disclosure of data and does not grant system modification or denial-of-service capabilities.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-83387"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557122",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557122"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-83387",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-83387"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83387",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83387"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:23:41.652000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance WebRowSets (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-83395",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-10-20T23:11:11.725999+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557110"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK. An unauthenticated remote attacker with network access could exploit this vulnerability by submitting crafted data to networking application programming interfaces (APIs). A successful attack could allow unauthorized modification or deletion of accessible data, or result in a partial Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate because successful exploitation requires specific environmental conditions, such as processing untrusted HTTP responses through client networking APIs, and cannot result in arbitrary code execution or unauthorized data exposure. In Red Hat environments, OpenJDK runtimes are exposed when Java applications handle responses from untrusted web endpoints or operate behind intermediary proxies subject to request desynchronization. Workloads that connect only to strictly trusted upstream servers are not exposed to this risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-83395"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557110",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557110"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-83395",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-83395"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83395",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83395"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:23:44.691000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-83400",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-10-21T00:23:52.318710+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557690"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java API for XML Processing (JAXP) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting crafted data across the network to applications that expose JAXP interfaces, such as through a web service. Successful exploitation can result in a partial Denial of Service (DoS), reducing the availability of the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance XML Processing (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate severity because, although remotely exploitable without authentication, the blast radius is confined to a partial denial of service without compromising system confidentiality or integrity. Java applications hosted on Red Hat platforms that parse untrusted XML input via exposed endpoints are potentially susceptible to resource exhaustion. Environments that do not ingest external XML payloads or that restrict access to trusted clients remain unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-83400"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557690",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557690"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-83400",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-83400"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83400",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83400"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:23:46.645000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance XML Processing (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-87290",
      "cwe": {
        "id": "CWE-91",
        "name": "XML Injection (aka Blind XPath Injection)"
      },
      "discovery_date": "2026-10-21T00:26:09.025376+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557731"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java API for XML Processing (JAXP) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to applications or web services that rely on vulnerable JAXP APIs. Successful exploitation can result in unauthorized information disclosure, allowing an attacker to access sensitive data managed by the Java application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance XPath Expressions (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux and Red Hat OpenJDK distributions because exploitation depends on high attack complexity, requiring specific conditions where applications handle untrusted external XML data using vulnerable JAXP XPath evaluation routines. Standard installations do not expose these interfaces directly to the network without custom application logic or specific web services consuming external inputs. Furthermore, the potential impact is constrained to unauthorized information disclosure without enabling arbitrary command execution or system modification.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-87290"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557731",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557731"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-87290",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-87290"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87290",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87290"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:23:51.453000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance XPath Expressions (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-87292",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
      },
      "discovery_date": "2026-10-20T23:53:30.411856+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557261"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OpenJDK networking component. This vulnerability may allow an unauthenticated remote attacker to cause unauthorized data modification. By supplying crafted input to exposed networking application programming interfaces (APIs), such as through a web service, an attacker can insert, update, or delete a subset of accessible data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance Network Clients (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates this vulnerability as Low impact due to the high attack complexity required to manipulate network client interactions and the absence of confidentiality or availability consequences. Exploitation requires an application to pass unsanitized input directly into networking client interfaces or execute untrusted sandboxed code, scenarios that are atypical in enterprise deployments. As a result, potential exposure is restricted to limited unauthorized data modifications under specialized execution conditions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-87292"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557261",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557261"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-87292",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-87292"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87292",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87292"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:23:52.207000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openjdk: Enhance Network Clients (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-87294",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-21T00:36:03.345990+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557906"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK. An unauthenticated remote attacker can exploit this issue across multiple network protocols by submitting crafted requests to application programming interfaces (APIs) within the Security component. Successful exploitation allows an attacker to modify or delete accessible application data, as well as gain unauthorized read access to sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate because, although it can be triggered over the network without authentication, the scope of impact is restricted to partial confidentiality and integrity compromise of data handled by the running Java process rather than complete system takeover. Enterprise deployments of Red Hat products running OpenJDK services are primarily at risk when applications process untrusted network traffic and rely on the core Security component for certificate name verification. Applications that do not accept external connections or perform custom certificate validation remain unaffected by this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-87294"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557906",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557906"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-87294",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-87294"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87294",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87294"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:23:52.938000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-87367",
      "cwe": {
        "id": "CWE-91",
        "name": "XML Injection (aka Blind XPath Injection)"
      },
      "discovery_date": "2026-10-21T00:16:13.349275+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557558"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the JAXP (Java API for XML Processing) component of OpenJDK. An unauthenticated remote attacker can exploit this vulnerability by providing crafted input to applications or web services that process data through JAXP APIs. Successful exploitation allows the attacker to perform unauthorized data modifications, including updating, inserting, or deleting accessible data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance Template Handling (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Low severity because successful exploitation requires high complexity and specially constructed input to JAXP template processing APIs, resulting in limited integrity impact without compromising confidentiality or service availability. In Red Hat Enterprise Linux and containerized OpenJDK environments, exposure is restricted to applications that accept untrusted XML or template data without adequate validation. General Java workloads that do not parse external template content remain unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-87367"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557558",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557558"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-87367",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-87367"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87367",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87367"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:24:19.687000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openjdk: Enhance Template Handling (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91332",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-10-20T23:04:12.620420+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557041"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s Networking component. An unauthenticated remote attacker with network access can exploit this vulnerability by sending crafted input to exposed networking Application Programming Interfaces (APIs). Successful exploitation allows the attacker to perform unauthorized data modifications, potentially inserting, altering, or deleting accessible application data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance HTTP Client (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate severity because, while it can be exploited remotely without privileges, the impact is confined to low integrity compromise without affecting system confidentiality or availability. The issue resides within OpenJDK\u0027s modern HTTP client stack, affecting Java applications that communicate with untrusted servers or through intermediate proxies. Deployments running OpenJDK 8 are not vulnerable because the affected HTTP client codebase is not present.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91332"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557041",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557041"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91332",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91332"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91332",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91332"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:21.977000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance HTTP Client (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91334",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-10-21T00:22:15.799669+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557662"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s ImageIO component. This vulnerability allows an unauthenticated remote attacker to cause information disclosure by submitting crafted inputs to applications or web services using the ImageIO application programming interface (API). Successful exploitation can result in unauthorized read access to a subset of accessible data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance JPEG loading (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Low impact for Red Hat products because successful exploitation requires high attack complexity and only enables unauthorized exposure of limited process memory, with no impact on data integrity or availability. Within Red Hat deployments, exposure is confined to Java applications that specifically ingest and decode untrusted graphic streams using the ImageIO subsystem. Workloads that do not process untrusted image files are not exposed to this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91334"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557662",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557662"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91334",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91334"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91334",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91334"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:22.651000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openjdk: Enhance JPEG loading (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91335",
      "cwe": {
        "id": "CWE-653",
        "name": "Improper Isolation or Compartmentalization"
      },
      "discovery_date": "2026-10-21T00:18:28.666628+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557598"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s Abstract Window Toolkit (AWT). A remote attacker with low privileges could exploit this vulnerability by convincing a user to run untrusted code within a sandboxed environment. Successful exploitation allows unauthorized read access to a subset of accessible data, leading to information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance Image Handling (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is evaluated as having a Low severity impact because exploitation requires complex prerequisites, including user interaction and authenticated access to an untrusted execution environment. Standard deployments across Red Hat Enterprise Linux and enterprise runtimes run only trusted server-side workloads rather than sandboxed client applications. Consequently, default production systems do not expose this attack vector, restricting the risk of unauthorized data disclosure to non-standard client configurations.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91335"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557598",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557598"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91335",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91335"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91335",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91335"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:22.996000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openjdk: Enhance Image Handling (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91373",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-21T00:01:44.146025+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557356"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s Java Secure Socket Extension (JSSE) component. An unauthenticated remote attacker with network access via Transport Layer Security (TLS) can exploit this vulnerability to cause a partial Denial of Service (DoS). This issue can be triggered when an application or web service processes untrusted network data using the affected JSSE APIs.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance TLS handshakes (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates this vulnerability as Moderate because it allows an unauthenticated network-adjacent or remote attacker to cause resource consumption resulting only in partial service degradation, rather than total denial of service or arbitrary code execution. Within Red Hat Enterprise Linux and containerized environments, exposure is restricted to Java workloads actively terminating TLS traffic using JSSE APIs. Confidentiality and data integrity remain unaffected, as the flaw does not facilitate unauthorized access to sensitive information or memory corruption.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91373"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557356",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557356"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91373",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91373"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91373",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91373"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:36.496000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance TLS handshakes (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91374",
      "cwe": {
        "id": "CWE-749",
        "name": "Exposed Dangerous Method or Function"
      },
      "discovery_date": "2026-10-21T00:16:49.118613+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557564"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Serviceability component of OpenJDK. An unauthenticated remote attacker can exploit this issue across the network by supplying crafted data to exposed application programming interfaces (APIs) or by running untrusted code within a sandboxed Java environment. Successful exploitation may lead to unauthorized data access, allowing the attacker to read and modify sensitive application data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance jstatd (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is evaluated as having a Moderate impact for Red Hat Enterprise Linux and OpenJDK environments because successful exploitation requires high attack complexity, such as untrusted sandboxed execution or network exposure of internal serviceability endpoints. In standard Red Hat deployments, diagnostic and serviceability tools are not active by default, and typical workloads do not expose these interfaces to unauthenticated network actors. Furthermore, the maximum impact is constrained to partial data disclosure and modification, without causing service disruption or providing full system compromise.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91374"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557564",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557564"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91374",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91374"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91374",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91374"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:36.857000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance jstatd (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91375",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-10-21T00:33:06.264015+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557857"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in openjdk. An unauthenticated attacker with local access to the host system could leverage this vulnerability in the Libraries component by convincing a user to interact with a malicious application or by supplying crafted input through exposed application programming interfaces (APIs). Successful exploitation allows the attacker to compromise data integrity, resulting in the unauthorized modification, creation, or deletion of critical data accessible to the Java runtime environment.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance jmod handling (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having a Moderate impact for Red Hat deployments because exploitation requires high attack complexity, local access, and user interaction, while the impact is strictly confined to data integrity. In typical enterprise environments, OpenJDK applications do not routinely process untrusted module archives unless explicitly architected to ingest external jmod files or untrusted input via exposed application interfaces. Furthermore, earlier runtimes such as OpenJDK 8 do not include modular runtime archive features and are unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91375"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557857",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557857"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91375",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91375"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91375",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91375"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:37.216000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance jmod handling (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91379",
      "cwe": {
        "id": "CWE-653",
        "name": "Improper Isolation or Compartmentalization"
      },
      "discovery_date": "2026-10-20T22:45:57.814362+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556824"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s JDK tools component. An unauthenticated local attacker can exploit this vulnerability by convincing a user to interact with untrusted code in an environment relying on the Java security sandbox. A successful attack can result in unauthorized creation, modification, or deletion of critical data accessible to the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance JShell (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate rather than Important because exploitation requires local access, user cooperation, and reliance on Java security sandbox boundaries to constrain untrusted code. Red Hat Enterprise Linux deployments predominantly run server-side Java applications that execute only administrator-provisioned trusted bytecode. Because standard production workflows do not process unvetted scripts through interactive JDK tools such as JShell, most enterprise installations are not exposed to this issue under default operations.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91379"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556824",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556824"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91379",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91379"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91379",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91379"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:38.600000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance JShell (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91380",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-10-20T22:48:13.943380+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556859"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OpenJDK Utility component. An unauthenticated attacker with local system access or the ability to supply data to affected application programming interfaces (APIs) can exploit this vulnerability. Successful exploitation can result in unauthorized data access, allowing an attacker to read confidential information as well as modify or delete application data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance Preferences (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate for Red Hat products because exploitation requires local access or direct exposure of vulnerable Preferences APIs to untrusted input, combined with high execution complexity that limits impact to partial confidentiality and integrity loss. In typical Red Hat Enterprise Linux and containerized Java deployments, applications rarely expose the underlying utility interfaces directly to unauthenticated external actors. Consequently, system-level compromise is not possible, and any potential threat remains restricted to the boundaries of the executing Java runtime process.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91380"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556859",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556859"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91380",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91380"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91380",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91380"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:38.943000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance Preferences (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91382",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-10-21T00:22:23.378283+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557665"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s 2D component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted data to an application that processes input using affected 2D APIs. Successful exploitation could allow the attacker to create, modify, or delete accessible data and cause a partial Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance Image Processing (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is classified as Moderate severity because successful exploitation demands high attack complexity, requiring an application to expose endpoints that feed untrusted graphical assets into OpenJDK 2D processing routines. In standard Red Hat Enterprise Linux deployments, Java applications are not broadly exposed unless services explicitly accept and render external image data without prior validation. Because the flaw cannot be leveraged to read confidential system memory or achieve arbitrary remote command execution, the impact remains limited to data tampering and partial service disruption within the executing runtime process.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91382"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557665",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557665"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91382",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91382"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91382",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91382"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:39.637000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance Image Processing (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91394",
      "cwe": {
        "id": "CWE-524",
        "name": "Use of Cache Containing Sensitive Information"
      },
      "discovery_date": "2026-10-21T00:41:14.425071+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557956"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OpenJDK Networking component. This vulnerability allows an unauthenticated remote attacker with network access to cause an information disclosure. By supplying crafted input to networking Application Programming Interfaces (APIs), such as through an exposed web service, an attacker could exploit this flaw to gain unauthorized access to critical data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance HTTP client caching (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having a Moderate severity rather than Important due to the high attack complexity required for successful exploitation. While unauthenticated remote callers could potentially trigger information exposure, exploitation hinges on target applications passing untrusted input directly into internal OpenJDK HTTP client caching routines. Workloads that do not process untrusted network requests through affected caching APIs are not exposed to this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91394"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557956",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557956"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91394",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91394"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91394",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91394"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:44.100000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance HTTP client caching (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91397",
      "cwe": {
        "id": "CWE-488",
        "name": "Exposure of Data Element to Wrong Session"
      },
      "discovery_date": "2026-10-20T22:59:49.519270+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557007"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s Serviceability component. An unauthenticated attacker with local access to the host system can exploit this vulnerability with user interaction, such as by supplying crafted input to Serviceability application programming interfaces (APIs). A successful attack can result in unauthorized modification or deletion of accessible data, as well as cause a partial Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having a Low impact because exploitation is constrained to local environments and necessitates both high execution complexity and specific user interaction. In typical server and container deployments running OpenJDK on Red Hat Enterprise Linux, the serviceability diagnostic interface is not directly exposed to untrusted users. Consequently, any potential unauthorized data alteration or localized denial of service carries a limited blast radius under standard operational conditions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91397"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557007",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557007"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91397",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91397"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91397",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91397"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:45.159000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 3.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91398",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2026-10-21T00:24:59.058513+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557711"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK. An unauthenticated remote attacker with network access can exploit this vulnerability through the SOCKS5 (Socket Secure) networking protocol to compromise data integrity. Successful exploitation allows unauthorized creation, modification, or deletion of application data and can extend beyond the Java environment to impact related systems.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having Moderate severity for Red Hat products because exploitation requires complex conditions involving specific SOCKS5 proxy protocol handling and does not directly lead to unauthorized disclosure of confidential information or denial of service. In typical Red Hat Enterprise Linux and containerized deployments, Java runtime environments do not commonly rely on SOCKS5 proxies across untrusted network perimeters. The risk is largely confined to specific architectures where applications explicitly establish SOCKS5 connections with untrusted intermediary proxies or accept arbitrary proxy configuration parameters from untrusted actors.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91398"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557711",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557711"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91398",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91398"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91398",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91398"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:45.513000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91400",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-20T22:35:48.178085+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556795"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Sound component of Java SE and GraalVM. This issue allows an unauthenticated remote attacker to cause a partial Denial of Service (DoS) by convincing a user to run untrusted code within a sandboxed Java environment.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Low severity because exploitation requires user interaction to parse malicious input and is restricted to causing a partial denial of service. OpenJDK environments on Red Hat Enterprise Linux are primarily deployed for server-side workloads executing trusted applications rather than sandboxed client applets. As a result, standard deployments that do not load or process untrusted multimedia sound resources are not exposed to significant operational risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91400"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556795",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556795"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91400",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91400"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91400",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91400"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:46.374000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91403",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-21T21:44:33.921248+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2558584"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The certificate authority (CA) store used in OpenJDK and Oracle Java included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL Java client applications and cause such applications to connect to malicious sites.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The non-portable OpenJDK RPM packages in Red Hat Enterprise Linux rely on ca-certificates packages for their default certificate store. Therefore, those OpenJDK versions require updated ca-certificates RPM package to be installed to address this issue (refer to CVE-2026-114406 for more details).\n\nThe portable OpenJDK builds for both Linux and Windows include their own certificate store and therefore need to be updated separately from the ca-certificates updates.\n\nThe certificate bundle in OpenJDK upstream included root certificates, which signed eMudhra certificates with weak keys. Upstream OpenJDK fix did not initially remove those root certificates, but rather only blocked problematic intermediate certificates. However, this fix was found to be insufficient and OpenJDK upstream later removed relevant root CA certificates, see CVE-2026-114820.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91403"
        },
        {
          "category": "external",
          "summary": "RHBZ#2558584",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558584"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91403",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91403"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91403",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91403"
        },
        {
          "category": "external",
          "summary": "https://openjdk.org/groups/vulnerability/advisories/2026-10-21",
          "url": "https://openjdk.org/groups/vulnerability/advisories/2026-10-21"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/alert-cve-2026-91403.html",
          "url": "https://www.oracle.com/security-alerts/alert-cve-2026-91403.html"
        }
      ],
      "release_date": "2026-10-21T21:23:28.057000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns"
    },
    {
      "cve": "CVE-2026-91410",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-10-21T00:04:49.787811+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557405"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Libraries component of OpenJDK. An unauthenticated remote attacker with network access can exploit this vulnerability by supplying crafted data to vulnerable application programming interfaces (APIs). Successful exploitation allows the attacker to cause a partial Denial of Service (DoS) of the application or service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance zipfs (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has evaluated this vulnerability as having a Moderate impact because exploitation is constrained to a partial denial of service without compromising system confidentiality or integrity. Exposure primarily affects Java applications that accept and process untrusted archive data using the internal zipfs file system provider. In typical environments where applications do not expose archive parsing interfaces to untrusted external callers, the operational risk remains limited.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91410"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557405",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557405"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91410",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91410"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91410",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91410"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:49.138000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance zipfs (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91415",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-10-21T00:07:18.992619+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557443"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s 2D component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to exposed application programming interfaces (APIs), such as through a web service or application that processes graphics data. A successful attack primarily allows an attacker to cause a Denial of Service (DoS) by triggering an application hang or crash, while also potentially permitting unauthorized reading or modification of a subset of accessible data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance font rendering (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important because unauthenticated remote threats can cause a full service disruption or compromise memory integrity in workloads utilizing OpenJDK 2D subsystems. In Red Hat Enterprise Linux and container environments, exposure is contingent on whether server applications ingest and render untrusted font or graphical assets. Java workloads that do not process external visual assets or expose rendering interfaces to network callers face minimal practical exposure.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91415"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557443",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557443"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91415",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91415"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91415",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91415"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:50.975000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openjdk: Enhance font rendering (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91418",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-10-21T00:22:57.705155+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557674"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s ImageIO component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to applications utilizing ImageIO APIs. Successful exploitation can result in a partial Denial of Service (DoS), degrading application availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance GIF loading (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has rated this vulnerability as Moderate because exploitation is limited to causing a partial denial of service, with no potential for unauthorized data disclosure or modification. In Red Hat Enterprise Linux environments, exposure is confined to Java applications that actively parse untrusted image assets through the standard ImageIO APIs. Workloads that do not accept or process external graphic files remain unaffected by this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91418"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557674",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557674"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91418"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91418",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91418"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:25:51.705000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance GIF loading (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91451",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-10-20T23:11:58.335143+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557117"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Networking component of OpenJDK. This vulnerability allows an unauthenticated remote attacker to cause unauthorized data modification by sending crafted input to exposed Application Programming Interfaces (APIs), such as through web services. Successful exploitation enables an attacker to insert, update, or delete data accessible to the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having a Moderate impact because exploitation is constrained to partial integrity loss without allowing unauthorized information disclosure or total denial of service. Within Red Hat environments, the issue primarily threatens Java applications that directly parse untrusted network traffic via built-in HTTP server networking APIs rather than through hardened reverse proxies. Even when successfully triggered by an unauthenticated remote attacker, the exploit cannot achieve arbitrary code execution or elevate privileges on the underlying operating system.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91451"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557117",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557117"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91451",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91451"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91451",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91451"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:26:02.855000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91452",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-10-20T23:44:29.335406+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557195"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Networking component of Oracle Java SE and GraalVM. An unauthenticated remote attacker can exploit this vulnerability by submitting crafted data across the network to exposed application programming interfaces (APIs), such as through a web service. A successful attack can allow an attacker to perform unauthorized modification, insertion, or deletion of accessible data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance HTTP server (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate impact for Red Hat products because, although it can be triggered remotely without authentication or user interaction, successful exploitation is limited to partial data integrity alterations without compromising confidentiality or system availability. Java runtime environments across Red Hat Enterprise Linux and Red Hat OpenJDK distributions are exposed when hosting web applications or network endpoints that parse untrusted requests via built-in HTTP server APIs. Due to inconsistent request processing, an external attacker submitting malformed requests can manipulate accessible data flows, but the flaw does not facilitate arbitrary code execution or broader infrastructure compromise.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91452"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557195",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557195"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91452",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91452"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91452",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91452"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:26:03.214000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance HTTP server (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91453",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-10-20T23:04:57.893720+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557047"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s Lightweight HTTP Server. An unauthenticated remote attacker can exploit this vulnerability over the network by sending crafted requests to exposed server Application Programming Interfaces (APIs). Successful exploitation allows an attacker to perform unauthorized data modifications, potentially inserting, altering, or deleting accessible application data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Improve HTTP headers (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate severity because exploitation requires an application to actively instantiate and expose the embedded OpenJDK lightweight HTTP server to untrusted network traffic, and successful attacks result only in partial integrity compromise without exposing data confidentiality or impacting service availability. OpenJDK packages shipped with Red Hat Enterprise Linux provide this lightweight server API primarily for embedded testing and lightweight standalone utilities rather than general-purpose production web services. Consequently, standard deployments that do not expose custom applications utilizing this specific internal HTTP server interface remain unaffected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91453"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557047",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557047"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91453",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91453"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91453",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91453"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:26:03.566000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Improve HTTP headers (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91461",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2026-10-20T22:46:53.031979+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556837"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java Secure Socket Extension (JSSE) component. An unauthenticated remote attacker could exploit this vulnerability over Transport Layer Security (TLS) by sending crafted data to affected application programming interfaces (APIs). A successful attack allows the attacker to cause unauthorized modification, insertion, or deletion of accessible data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance TLS Extensions (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Low severity because successful exploitation requires difficult-to-achieve attack conditions over TLS and produces only limited integrity impact without compromising system confidentiality or service availability. In Red Hat environments, exposure is restricted to Java workloads that expose JSSE endpoints to untrusted network traffic or process malicious handshakes. Standard Red Hat Enterprise Linux deployments do not expose these interfaces by default without explicitly configured network-facing Java services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91461"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556837",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556837"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91461",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91461"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91461",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91461"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:26:05.674000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "openjdk: Enhance TLS Extensions (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91462",
      "cwe": {
        "id": "CWE-354",
        "name": "Improper Validation of Integrity Check Value"
      },
      "discovery_date": "2026-10-20T23:49:52.141916+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557236"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Java Generic Security Services (JGSS) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted requests to exposed application programming interfaces (APIs), such as through a web service. A successful attack allows the unauthorized creation, deletion, or modification of critical data accessible to the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance krb5 tokens (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated with a Moderate severity rather than Important because exploitation involves high attack complexity and specifically depends on custom Java deployments exposing JGSS Kerberos token parsing to unauthenticated network input. In standard Red Hat Enterprise Linux environments, OpenJDK provides underlying cryptographic and authentication libraries, but exploitation cannot occur automatically without an application processing untrusted authentication tokens. Additionally, successful exploitation affects data integrity without directly threatening system availability or data confidentiality.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91462"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557236",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557236"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91462",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91462"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91462",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91462"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:26:06.021000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance krb5 tokens (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91463",
      "cwe": {
        "id": "CWE-749",
        "name": "Exposed Dangerous Method or Function"
      },
      "discovery_date": "2026-10-21T00:28:48.205982+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557780"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the JGSS (Java Generic Security Services) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code in deployments relying on the Java sandbox. Successful exploitation can result in unauthorized access to sensitive data accessible to the Java environment.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance krb5 client (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as having Moderate impact because exploitation requires tricking a user into executing untrusted code within an environment that relies on sandbox restrictions, combined with high attack complexity. In typical Red Hat deployments, OpenJDK is utilized for server-side infrastructure and enterprise applications that execute solely trusted code managed by administrators. Because these standard server environments do not rely on the Java security sandbox for isolation, they are not exposed under default operational configurations.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91463"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557780",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557780"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91463",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91463"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91463",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91463"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:26:06.372000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance krb5 client (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91464",
      "cwe": {
        "id": "CWE-303",
        "name": "Incorrect Implementation of Authentication Algorithm"
      },
      "discovery_date": "2026-10-21T00:24:53.048347+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557709"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenJDK\u0027s Java Generic Security Services (JGSS) component. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code within a sandboxed Java environment. Successful exploitation results in unauthorized information disclosure, allowing the attacker to access sensitive data accessible to the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance Kerberos validation (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is assessed as Moderate impact because exploitation requires high attack complexity and user interaction to execute untrusted code inside an isolated Java sandbox. In typical Red Hat deployments, OpenJDK powers server-side applications running exclusively trusted administrative code rather than untrusted client applets. As enterprise workloads do not depend on the deprecated Java sandbox mechanisms for security, standard deployments are not exposed to this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91464"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557709",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557709"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91464",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91464"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91464",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91464"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:26:06.710000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance Kerberos validation (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-91487",
      "cwe": {
        "id": "CWE-1025",
        "name": "Comparison Using Wrong Factors"
      },
      "discovery_date": "2026-10-20T22:23:21.307778+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556709"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OpenJDK Compiler component. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted data to exposed application programming interfaces (APIs), such as through a web service. Successful exploitation could allow the attacker to read, update, or delete a subset of accessible data without authorization.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance C2 comparisons (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated with Moderate impact for Red Hat products because triggering the condition requires high attack complexity, specialized target inputs, and grants only partial read or modification privileges without impacting service availability. In typical enterprise environments running Red Hat OpenJDK, the flaw resides in the JIT compiler during bytecode compilation and cannot be leveraged for arbitrary remote code execution. Exploitation requires an attacker to interact with network services that pass tailored parameters through vulnerable methods, limiting the overall blast radius to the context of the running application.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-91487"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556709",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556709"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-91487",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-91487"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91487",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91487"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:26:13.608000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance C2 comparisons (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-101516",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-20T23:08:33.332965+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2557079"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OpenJDK Libraries component. An unauthenticated remote attacker can exploit this vulnerability over a network by submitting crafted data to affected application programming interfaces (APIs), or through sandboxed environments that execute untrusted Java code. Successful exploitation allows the attacker to modify, insert, or delete accessible data, as well as gain unauthorized read access to sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-101516"
        },
        {
          "category": "external",
          "summary": "RHBZ#2557079",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557079"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-101516",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-101516"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-101516",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101516"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
        }
      ],
      "release_date": "2026-10-20T21:21:18.319000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10)"
    },
    {
      "cve": "CVE-2026-114820",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-24T18:50:57.271768+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2560322"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The certificate authority (CA) store used in OpenJDK and Oracle Java included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL Java client applications and cause such applications to connect to malicious sites.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The non-portable OpenJDK RPM packages in Red Hat Enterprise Linux rely on ca-certificates packages for their default certificate store. Therefore, those OpenJDK versions require updated ca-certificates RPM package to be installed to address this issue (refer to CVE-2026-114406 for more details).\n\nThe portable OpenJDK builds for both Linux and Windows include their own certificate store and therefore neeed to be updated separately from the ca-certificates updates.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Build of OpenJDK 17.0.21"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-114820"
        },
        {
          "category": "external",
          "summary": "RHBZ#2560322",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560322"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-114820",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-114820"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114820",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114820"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/alert-cve-2026-114820.html",
          "url": "https://www.oracle.com/security-alerts/alert-cve-2026-114820.html"
        }
      ],
      "release_date": "2026-10-24T18:42:04.571000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-27T19:53:15+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat Build of OpenJDK 17.0.21"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88353"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Build of OpenJDK 17.0.21"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns"
    }
  ]
}