Critical Security Update for java-1.8.0-openjdk: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:0932: Important: java-1.8.0-openjdk security update. Affects java-1.8.0-openjdk versions < 1:1.8.0.482.b08-1.el8. Fixed in 1:1.8.0.482.b08-1.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-1.8.0-openjdk package provides the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit, which are essential for running Java applications and developing Java software. This package is widely used in various applications and environments, making its security paramount. The recent vulnerabilities identified pose significant risks, including potential unauthorized access and data breaches.
Vulnerability Detail
The vulnerabilities stem from several issues within the java-1.8.0-openjdk package, including improvements in JMX connections (CVE-2026-21925), HttpServer request handling (CVE-2026-21933), and certificate checking (CVE-2026-21945). Additionally, there are critical buffer overflow vulnerabilities in the libpng library (CVE-2025-64720, CVE-2025-65018) that could lead to arbitrary code execution. These vulnerabilities can be exploited by attackers to gain unauthorized access to sensitive information or disrupt service availability.
How To Fix
Minimum fixed version
1:1.8.0.482.b08-1.el8
This is the first release that contains the fix.
sudo dnf update java-1.8.0-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling features that utilize the vulnerable components, such as JMX connections and HttpServer, until the package can be updated. However, this may limit functionality and should only be a short-term solution.
Conclusion
The vulnerabilities in the java-1.8.0-openjdk package pose significant risks to applications relying on this software. It is crucial to update to the latest patched version to mitigate these risks. Users should also consider using tools like Vulert to monitor their applications for vulnerabilities effectively.
See every vulnerability recorded for java-1.8.0-openjdk →
FAQ
The vulnerabilities can lead to unauthorized access, data breaches, and potential service disruptions.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software by simply uploading your manifest file like package-lock.json.
Consider implementing workarounds, such as disabling vulnerable features, until you can apply the necessary updates.
Yes, several related packages, including java-1.8.0-openjdk-accessibility and java-1.8.0-openjdk-devel, are also affected and should be updated.
Detailed information can be found on the CVE pages linked in the security advisory for java-1.8.0-openjdk.
Related vulnerabilities
Recent vulnerabilities recorded for java-1.8.0-openjdk.
