Critical Security Update for Java-21-OpenJDK: Multiple Vulnerabilities Addressed
Summary
RHSA-2026:9689: Red Hat Security Advisory: java-21-openjdk security update. Affects java-21-openjdk versions < 1:21.0.11.0.10-1.el10_2. Fixed in 1:21.0.11.0.10-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Java-21-OpenJDK is an open-source implementation of the Java Platform, Standard Edition. It provides a robust environment for developing and running Java applications. The package includes essential libraries, tools, and a runtime environment that enables developers to create cross-platform applications. However, recent vulnerabilities have been identified that could potentially compromise the security of applications relying on this package.
Vulnerability Detail
The vulnerabilities identified in Java-21-OpenJDK stem from various issues, including improper input validation and memory management flaws. These vulnerabilities can lead to remote code execution, denial of service, and data leakage. Attackers can exploit these weaknesses to gain unauthorized access to sensitive information or disrupt service availability. The vulnerabilities have been cataloged under multiple CVEs, including CVE-2026-22007 and CVE-2026-22021, with a CVSS score of 7.5 indicating a high severity level.
How To Fix
Minimum fixed version
1:21.0.11.0.10-1.el10_2
This is the first release that contains the fix.
sudo dnf update java-21-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing the following workaround: restrict access to the Java application by configuring firewall rules to limit incoming traffic only to trusted IP addresses. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
In summary, the Java-21-OpenJDK package has critical vulnerabilities that need immediate attention. Updating to the latest version is crucial to maintaining the security and integrity of applications built on this platform. Implementing workarounds can provide temporary relief, but they do not replace the need for a proper update.
See every vulnerability recorded for java-21-openjdk →
FAQ
The CVSS score of the vulnerabilities is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Failure to address these vulnerabilities could lead to unauthorized access, data breaches, and service disruptions.
Continuing to use Java-21-OpenJDK without updating poses significant security risks. It is highly recommended to apply the updates as soon as possible.
If you encounter issues after updating, consider rolling back to the previous version or consulting the Java-21-OpenJDK documentation for troubleshooting steps.
References
Related vulnerabilities
Recent vulnerabilities recorded for java-21-openjdk.
