Moderate Security Update for java-21-openjdk: Enhancements to Resource Resolving, HTTP Connections, and TLS Server
Summary
RLSA-2026:55787: Moderate: java-21-openjdk security update. Affects java-21-openjdk versions < 1:21.0.12.1.1-1.1.el8_10. Fixed in 1:21.0.12.1.1-1.1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-21-openjdk package provides the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. It is widely used for developing and running Java applications, offering a robust platform with features such as garbage collection, security enhancements, and support for modern Java language features. However, vulnerabilities in this package can expose applications to security risks, necessitating timely updates.
Vulnerability Detail
The vulnerabilities identified in the java-21-openjdk package include improvements in resource resolving (CVE-2026-60589), enhancements to HTTP connections (CVE-2026-61308), and upgrades to the TLS server (CVE-2026-70907). These vulnerabilities could allow unauthorized access to resources, potential data leaks, and exploitation of insecure connections, leading to significant security breaches in applications relying on this package.
How To Fix
Minimum fixed version
1:21.0.12.1.1-1.1.el8_10
This is the first release that contains the fix.
sudo dnf update java-21-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the affected applications or services until the package can be updated. Additionally, review your application's configurations to ensure they are not exposing sensitive data through insecure connections.
Conclusion
In summary, the java-21-openjdk package has been identified with several moderate vulnerabilities that could impact the security of applications. It is crucial for users to update to the latest version to ensure their systems remain secure. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for java-21-openjdk →
FAQ
The CVSS score of the vulnerability is 6.8, indicating a moderate level of risk.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The update addresses vulnerabilities related to resource resolving, HTTP connections, and TLS server enhancements, which could lead to unauthorized access and data leaks.
Yes, not updating the package could expose your applications to security risks, including unauthorized access and potential data breaches.
Users are strongly advised to update to the latest patched version of java-21-openjdk to mitigate the identified vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for java-21-openjdk.
