Moderate Security Update for java-17-openjdk: Enhancements to Resource Resolving, HTTP Connections, and TLS Server
Summary
RLSA-2026:55781: Moderate: java-17-openjdk security update. Affects java-17-openjdk versions < 1:17.0.20.1.1-1.1.el8_10. Fixed in 1:17.0.20.1.1-1.1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-17-openjdk package provides the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit, which are essential for running Java applications and developing Java software. This package is widely used in various environments due to its open-source nature and compliance with Java standards. However, recent vulnerabilities have been identified that could potentially compromise the security of applications relying on this package.
Vulnerability Detail
The vulnerabilities identified in the java-17-openjdk package include improvements in resource resolving (CVE-2026-60589), enhancements to HTTP connections (CVE-2026-61308), and upgrades to the TLS server (CVE-2026-70907). These vulnerabilities could allow attackers to exploit weaknesses in resource handling, HTTP communication, and secure connections, leading to unauthorized access or data breaches. The CVSS score for this vulnerability is 6.8, indicating a moderate level of risk.
How To Fix
Minimum fixed version
1:17.0.20.1.1-1.1.el8_10
This is the first release that contains the fix.
sudo dnf update java-17-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not feasible, consider restricting access to the affected applications and monitoring network traffic for any suspicious activity as a temporary workaround.
Conclusion
In summary, the java-17-openjdk package has been identified with several vulnerabilities that could compromise the security of Java applications. It is crucial to update to the latest patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for java-17-openjdk →
FAQ
The java-17-openjdk package provides the OpenJDK 17 Java Runtime Environment and Software Development Kit, which are essential for running and developing Java applications.
The main vulnerabilities include issues with resource resolving, HTTP connections, and TLS server enhancements, which could lead to unauthorized access or data breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By uploading a manifest file like package-lock.json, you can check if your application is affected.
The CVSS score for this vulnerability is 6.8, indicating a moderate level of risk associated with the identified issues.
You can update the package by running the command 'sudo yum update java-17-openjdk' in your terminal to ensure you have the latest security fixes.
References
Related vulnerabilities
Recent vulnerabilities recorded for java-17-openjdk.
