Critical Security Update for Java 21 OpenJDK: CVE-2026-60589, CVE-2026-61308, CVE-2026-70907
Summary
RHSA-2026:55787: Red Hat Security Advisory: java-21-openjdk security update. Affects java-21-openjdk versions < 1:21.0.12.1.1-1.1.el10. Fixed in 1:21.0.12.1.1-1.1.el10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Java 21 OpenJDK is an open-source implementation of the Java Platform, Standard Edition. It provides a robust environment for developing and running Java applications. This package is widely used in enterprise environments due to its performance, reliability, and extensive libraries. However, recent vulnerabilities have been identified that could compromise the security of applications relying on this package.
Vulnerability Detail
The vulnerabilities identified in Java 21 OpenJDK (CVE-2026-60589, CVE-2026-61308, CVE-2026-70907) stem from improper input validation and memory management issues. These vulnerabilities could allow an attacker to execute arbitrary code, leading to potential data breaches or system compromise. The vulnerabilities are particularly concerning as they can be exploited remotely, affecting systems that utilize Java applications without adequate security measures.
How To Fix
Minimum fixed version
1:21.0.12.1.1-1.1.el10
This is the first release that contains the fix.
sudo dnf update java-21-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing network-level restrictions to limit access to the affected systems. Additionally, review and enhance input validation mechanisms in applications utilizing Java 21 OpenJDK to mitigate potential exploitation.
Conclusion
In summary, the identified vulnerabilities in Java 21 OpenJDK pose significant risks to applications relying on this package. Immediate action is required to update to the patched versions to mitigate these risks. Regular monitoring and adherence to security best practices are essential to maintain application integrity.
See every vulnerability recorded for java-21-openjdk →
FAQ
The main vulnerabilities are CVE-2026-60589, CVE-2026-61308, and CVE-2026-70907, which involve improper input validation and memory management issues.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without requiring any signup.
The CVSS score for these vulnerabilities is 6.8, indicating a moderate to high severity level.
Update your Java 21 OpenJDK package to the patched version immediately and review your application's input validation mechanisms.
Yes, Vulert can monitor and alert in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for java-21-openjdk.
