Critical Security Update for java-21-openjdk: Important Vulnerabilities Addressed
Summary
ALSA-2026:0928: Important: java-21-openjdk security update. Affects java-21-openjdk versions < 1:21.0.10.0.7-1.el10.alma.1. Fixed in 1:21.0.10.0.7-1.el10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-21-openjdk package provides the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit, which are essential for running Java applications. This package is widely used in various environments for developing and executing Java-based applications. However, it has been identified to have several security vulnerabilities that could potentially compromise the integrity and security of applications relying on it.
Vulnerability Detail
The vulnerabilities in the java-21-openjdk package stem from issues in JMX connections, HttpServer request handling, and certificate checking, as well as buffer overflow vulnerabilities in the libpng library. These vulnerabilities can lead to unauthorized access, data corruption, or application crashes, posing significant risks to systems utilizing this package.
How To Fix
Minimum fixed version
1:21.0.10.0.7-1.el10.alma.1
This is the first release that contains the fix.
sudo dnf update java-21-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of affected features or disable JMX connections and HttpServer functionalities until the package is updated. However, this is not a permanent solution and should only be used as a stopgap measure.
Conclusion
In summary, the java-21-openjdk package has critical vulnerabilities that need to be addressed promptly. Updating to the latest patched version is essential to ensure the security and integrity of applications relying on this package. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for java-21-openjdk →
FAQ
The main issues include vulnerabilities in JMX connections, HttpServer request handling, and certificate checking, as well as buffer overflow vulnerabilities in the libpng library.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By simply using a manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
Failure to address these vulnerabilities can lead to unauthorized access, data corruption, or application crashes, which can severely impact the security and functionality of your applications.
Yes, you can utilize Vulert's playground to monitor vulnerabilities in your application. It allows you to check for vulnerabilities without requiring signup.
If immediate updates are not possible, consider implementing workarounds such as disabling affected features or limiting their use until the package can be updated.
Related vulnerabilities
Recent vulnerabilities recorded for java-21-openjdk.
