Critical Security Flaw in java-21-openjdk: Red Hat Security Advisory
Summary
RHSA-2026:42895: Red Hat Security Advisory: java-21-openjdk security update. Affects java-21-openjdk versions < 1:21.0.12.0.8-1.1.el10_2. Fixed in 1:21.0.12.0.8-1.1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The java-21-openjdk package is an open-source implementation of the Java Platform, Standard Edition, which provides a robust environment for developing and running Java applications. It is widely used in enterprise environments for its performance and reliability. However, recent vulnerabilities have been identified that could compromise the security of applications relying on this package.
Vulnerability Detail
The vulnerabilities identified in java-21-openjdk stem from multiple sources, including improper input validation and insufficient access controls. These flaws can lead to unauthorized access, data leakage, and potential system compromise. The vulnerabilities are tracked under several CVEs, including CVE-2026-41254 and CVE-2026-46917, with a CVSS score of 7.5 indicating a high severity level. Attackers could exploit these vulnerabilities to execute arbitrary code or escalate privileges, posing significant risks to affected systems.
How To Fix
Minimum fixed version
1:21.0.12.0.8-1.1.el10_2
This is the first release that contains the fix.
sudo dnf update java-21-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the affected applications and monitoring for unusual activity. Additionally, you can disable any features that rely on the vulnerable components until the package is updated.
Conclusion
The java-21-openjdk package has critical vulnerabilities that require immediate attention. Updating to the latest patched version is essential to safeguard your applications and systems. Regular monitoring and using tools like Vulert can help maintain security and prevent future vulnerabilities.
See every vulnerability recorded for java-21-openjdk →
FAQ
The CVSS score of the vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring signup.
The potential impacts include unauthorized access, data leakage, and system compromise, which could lead to significant security breaches.
Yes, a patched version of the java-21-openjdk package is available. Update to version 1:21.0.12.0.8-1.1.el10_2.
If immediate updates are not possible, restrict access to affected applications and monitor for unusual activity as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for java-21-openjdk.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
