Security Update for OpenJDK 25: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:55798: Moderate: java-25-openjdk security update. Affects java-25-openjdk versions < 1:25.0.4.1.1-1.1.el10.alma.1. Fixed in 1:25.0.4.1.1-1.1.el10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenJDK 25 is an open-source implementation of the Java Platform, Standard Edition, providing a robust environment for developing and running Java applications. It includes the Java Runtime Environment (JRE) and the Java Software Development Kit (SDK). This version is widely used in enterprise applications and is known for its performance and security features. However, recent vulnerabilities have been identified that could potentially compromise the integrity and security of applications built on this platform.
Vulnerability Detail
The vulnerabilities in OpenJDK 25 include issues related to resource resolving, HTTP connections, font loading, and TLS server enhancements. Specifically, CVE-2026-60589 addresses resource resolving improvements, CVE-2026-61308 enhances HTTP connections, CVE-2026-70906 improves font loading, and CVE-2026-70907 enhances TLS server security. These vulnerabilities could allow attackers to exploit weaknesses in the Java environment, leading to unauthorized access, data breaches, or denial of service.
How To Fix
Minimum fixed version
1:25.0.4.1.1-1.1.el10.alma.1
This is the first release that contains the fix.
sudo dnf update java-25-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing network-level security measures such as firewalls and intrusion detection systems to mitigate potential attacks while planning for an update.
Conclusion
In summary, the recent security update for OpenJDK 25 addresses critical vulnerabilities that could impact the security of Java applications. It is crucial for users to update their packages to the latest patched versions to mitigate risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for java-25-openjdk →
FAQ
The main vulnerabilities include issues with resource resolving, HTTP connections, font loading, and TLS server enhancements, which could be exploited by attackers.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to install any software.
If you cannot update immediately, implement network security measures to protect your applications while planning for an update.
Detailed information about the vulnerabilities can be found on the respective CVE pages: CVE-2026-60589, CVE-2026-61308, CVE-2026-70906, and CVE-2026-70907.
Yes, you can use Vulert's playground to continuously monitor your application for vulnerabilities without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for java-25-openjdk.
