Moderate Security Update for java-25-openjdk: Enhancements and Fixes
Summary
RLSA-2026:55798: Moderate: java-25-openjdk security update. Affects java-25-openjdk versions < 1:25.0.4.1.1-1.1.el10_2. Fixed in 1:25.0.4.1.1-1.1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-25-openjdk package provides the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. It is widely used for developing and running Java applications, offering features such as improved performance, security, and support for modern Java standards. However, recent vulnerabilities have been identified that could impact the security and functionality of applications relying on this package.
Vulnerability Detail
The vulnerabilities in the java-25-openjdk package include issues related to resource resolving (CVE-2026-60589), HTTP connections (CVE-2026-61308), font loading (CVE-2026-70906), and TLS server enhancements (CVE-2026-70907). These vulnerabilities can lead to potential exploitation, allowing attackers to manipulate resource loading, compromise HTTP connections, or exploit weaknesses in font handling and TLS configurations. The CVSS score for this vulnerability is 7.5, indicating a moderate severity level that requires attention.
How To Fix
Minimum fixed version
1:25.0.4.1.1-1.1.el10_2
This is the first release that contains the fix.
sudo dnf update java-25-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider restricting access to applications using the vulnerable package or implementing additional security measures such as firewalls or intrusion detection systems to mitigate potential risks.
Conclusion
The java-25-openjdk package has several identified vulnerabilities that require immediate attention. Updating to the latest patched version is crucial to maintaining the security and integrity of Java applications. Utilize tools like Vulert to monitor for vulnerabilities and ensure your software remains secure.
See every vulnerability recorded for java-25-openjdk →
FAQ
The vulnerabilities can lead to security breaches, including unauthorized access and data manipulation, affecting the integrity and confidentiality of applications.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring a signup.
The CVSS score for this vulnerability is 7.5, indicating a moderate severity level that necessitates prompt action.
Yes, Vulert provides a solution that uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in your software.
If you cannot update the package immediately, consider implementing workarounds such as restricting access to the affected applications or enhancing your security measures.
References
Related vulnerabilities
Recent vulnerabilities recorded for java-25-openjdk.
