Critical Security Update for java-25-openjdk: Enhancements and Fixes
Summary
ALSA-2026:42899: Important: java-25-openjdk security update. Affects java-25-openjdk versions < 1:25.0.4.0.7-1.1.el10_2.alma.1. Fixed in 1:25.0.4.0.7-1.1.el10_2.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-25-openjdk package provides the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. It is widely used for developing and running Java applications, offering features such as a robust runtime environment, support for various libraries, and tools for developers. However, recent vulnerabilities have been identified that could compromise the security of applications relying on this package.
Vulnerability Detail
The vulnerabilities in java-25-openjdk stem from several issues, including inadequate TLS certificate handling (CVE-2026-46968), flaws in DTLS handshaking (CVE-2026-46917), and weaknesses in JPEG handling (CVE-2026-47010). These vulnerabilities could allow attackers to exploit the Java environment, potentially leading to unauthorized access, data breaches, or execution of arbitrary code. The vulnerabilities are critical as they affect core functionalities of the Java platform, making it essential to address them promptly.
How To Fix
Minimum fixed version
1:25.0.4.0.7-1.1.el10_2.alma.1
This is the first release that contains the fix.
sudo dnf update java-25-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider disabling features that rely on the affected components, such as TLS or DTLS, until the update can be applied. However, this may limit the functionality of applications relying on secure communications.
Conclusion
In summary, the java-25-openjdk package has critical vulnerabilities that need immediate attention. Updating to the latest patched version is essential to maintain the security of applications using this package. Utilize tools like Vulert to monitor vulnerabilities effectively.
See every vulnerability recorded for java-25-openjdk →
FAQ
The vulnerabilities can lead to unauthorized access, data breaches, or execution of arbitrary code, compromising the security of applications.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Consider disabling features that rely on the affected components until the update can be applied, but be aware this may limit application functionality.
It is recommended to check for updates regularly, at least once a month, to ensure that you are protected against known vulnerabilities.
Vulert monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file, making it easy to stay informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for java-25-openjdk.
