Critical Security Update for java-25-openjdk: Enhancements and Vulnerabilities Addressed
Summary
RLSA-2026:9693: Important: java-25-openjdk security update. Affects java-25-openjdk versions < 1:25.0.3.0.9-1.el10_1. Fixed in 1:25.0.3.0.9-1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-25-openjdk package provides the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit, which are essential for running Java applications and developing Java software. This package is widely used in various environments, including server-side applications and desktop software. The recent security update addresses multiple vulnerabilities that could potentially compromise the integrity and security of applications relying on this package.
Vulnerability Detail
The vulnerabilities in the java-25-openjdk package stem from various issues, including enhancements in crypto algorithm support, improvements in Kerberos credentialing, and updates to third-party libraries. These vulnerabilities could lead to denial of service, arbitrary code execution, and information disclosure. The vulnerabilities are identified by multiple CVEs, including CVE-2026-22007, CVE-2026-22008, and others, with a CVSS score of 7.6 indicating a high severity level.
How To Fix
Minimum fixed version
1:25.0.3.0.9-1.el10_1
This is the first release that contains the fix.
sudo dnf update java-25-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing strict access controls and monitoring for unusual activity within your Java applications to mitigate potential risks until the package can be updated.
Conclusion
The java-25-openjdk package has received a critical security update that addresses multiple vulnerabilities, enhancing its security and functionality. It is crucial for users to update to the latest version to protect their applications from potential threats. Utilizing tools like Vulert can help monitor for vulnerabilities in real-time.
See every vulnerability recorded for java-25-openjdk →
FAQ
The CVSS score of the vulnerability is 7.6, indicating a high severity level.
The update addresses vulnerabilities related to crypto algorithm support, Kerberos credentialing, and third-party library issues, among others.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update the package immediately, implement strict access controls and monitor your applications for unusual activity to mitigate risks.
The updates to third-party libraries address critical vulnerabilities that could lead to denial of service or arbitrary code execution, enhancing the overall security of the java-25-openjdk package.
References
Related vulnerabilities
Recent vulnerabilities recorded for java-25-openjdk.
