Critical Security Update for java-25-openjdk: Enhancements and Vulnerabilities Addressed
Summary
ALSA-2026:9693: Important: java-25-openjdk security update. Affects java-25-openjdk versions < 1:25.0.3.0.9-1.el10_2. Fixed in 1:25.0.3.0.9-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-25-openjdk package provides the OpenJDK 25 Java Runtime Environment and the Java Software Development Kit, which are essential for running and developing Java applications. This package includes various tools and libraries that facilitate Java programming and execution. The recent security update addresses multiple vulnerabilities that could potentially compromise the integrity and security of applications relying on this package.
Vulnerability Detail
The vulnerabilities addressed in this update include enhancements to cryptographic algorithms, improvements in memory allocation, and better handling of Kerberos credentials. Specific issues such as denial of service through buffer overflow, information disclosure, and arbitrary code execution due to use-after-free vulnerabilities in third-party libraries were also identified. These vulnerabilities could lead to severe security risks, including unauthorized access to sensitive data and system crashes.
How To Fix
Minimum fixed version
1:25.0.3.0.9-1.el10_2
This is the first release that contains the fix.
sudo dnf update java-25-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider restricting access to applications using the affected package and monitoring for unusual activity. Additionally, ensure that all security measures, such as firewalls and intrusion detection systems, are in place to mitigate potential risks.
Conclusion
The recent security update for java-25-openjdk addresses critical vulnerabilities that could impact the security and functionality of Java applications. Users are strongly encouraged to update to the latest patched version to mitigate these risks effectively.
See every vulnerability recorded for java-25-openjdk →
FAQ
The java-25-openjdk package is crucial for running Java applications and provides the necessary tools for Java development.
The update addresses vulnerabilities related to cryptographic algorithms, memory allocation, and third-party library issues that could lead to denial of service and arbitrary code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not feasible, restrict access to the applications using the affected package and enhance monitoring for any suspicious activity.
For more details about the vulnerabilities, refer to the CVE pages listed in the advisory or consult the official OpenJDK documentation.
Related vulnerabilities
Recent vulnerabilities recorded for java-25-openjdk.
