Security Update for java-17-openjdk: Moderate Vulnerability Resolved
Summary
ALSA-2026:55781: Moderate: java-17-openjdk security update. Affects java-17-openjdk versions < 1:17.0.20.1.1-1.1.el8. Fixed in 1:17.0.20.1.1-1.1.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-17-openjdk package provides the OpenJDK 17 Java Runtime Environment and Software Development Kit, essential for running and developing Java applications. This package is widely used in various environments due to its open-source nature and compliance with Java standards. However, it has recently been identified as vulnerable to several security issues that could potentially compromise the integrity and security of applications relying on it.
Vulnerability Detail
The vulnerability stems from multiple security flaws in the java-17-openjdk package, specifically: CVE-2026-60589, which improves resource resolving; CVE-2026-61308, which enhances HTTP connections; and CVE-2026-70907, which enhances TLS server capabilities. These vulnerabilities could allow attackers to exploit weaknesses in resource handling, HTTP connections, and TLS configurations, potentially leading to unauthorized access or data breaches.
How To Fix
Minimum fixed version
1:17.0.20.1.1-1.1.el8
This is the first release that contains the fix.
sudo dnf update java-17-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing network-level security measures such as firewalls to restrict access to vulnerable components until the update can be applied.
Conclusion
In summary, the java-17-openjdk package has been identified with moderate vulnerabilities that could impact application security. It is essential to update to the latest patched versions to safeguard against potential exploits. Users are encouraged to monitor their applications using tools like Vulert for real-time vulnerability alerts.
See every vulnerability recorded for java-17-openjdk →
FAQ
The vulnerabilities can lead to unauthorized access, data breaches, and exploitation of applications relying on the affected package.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions prior to 1:17.0.20.1.1-1.1.el8 for AlmaLinux 8 and 1:17.0.20.1.1-1.2.el9.alma.1 for AlmaLinux 9 are affected.
Yes, implementing network security measures such as firewalls can help mitigate risks until the patch is applied.
For more details, refer to the CVE pages listed in the references section of the vulnerability advisory.
Related vulnerabilities
Recent vulnerabilities recorded for java-17-openjdk.
