Security Update for java-21-openjdk: Moderate Vulnerability Addressed
Summary
ALSA-2026:55787: Moderate: java-21-openjdk security update. Affects java-21-openjdk versions < 1:21.0.12.1.1-1.2.el10.alma.1. Fixed in 1:21.0.12.1.1-1.2.el10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-21-openjdk package provides the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. It is widely used for developing and running Java applications, offering features like garbage collection, just-in-time compilation, and a rich API. This package is crucial for developers and enterprises relying on Java for their applications. However, recent vulnerabilities have been identified that could compromise the security of applications built on this platform.
Vulnerability Detail
The vulnerabilities identified in the java-21-openjdk package include issues related to resource resolving (CVE-2026-60589), HTTP connections (CVE-2026-61308), and TLS server enhancements (CVE-2026-70907). These vulnerabilities could allow attackers to exploit weaknesses in resource handling, potentially leading to unauthorized access or data breaches. The vulnerabilities stem from flaws in the implementation of Java's networking and security protocols, which could be leveraged by malicious actors to compromise the integrity and confidentiality of data.
How To Fix
Minimum fixed version
1:21.0.12.1.1-1.2.el10.alma.1
This is the first release that contains the fix.
sudo dnf update java-21-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing network-level security measures such as firewalls and intrusion detection systems to mitigate the risk of exploitation. Additionally, review and restrict access to sensitive resources and monitor application logs for any unusual activity.
Conclusion
The java-21-openjdk package has been identified with several moderate vulnerabilities that could impact the security of Java applications. It is crucial to update to the patched versions to mitigate these risks. Implementing security measures and monitoring can help protect applications until updates are applied.
See every vulnerability recorded for java-21-openjdk →
FAQ
The vulnerabilities could lead to unauthorized access, data breaches, or exploitation of application resources.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement network security measures and monitor application logs for unusual activity as a temporary workaround.
Yes, several related packages such as java-21-openjdk-demo, java-21-openjdk-devel, and others are also affected.
Regularly check for updates, ideally on a weekly basis, to ensure that you are protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for java-21-openjdk.
