Critical Security Update for Java 25 OpenJDK: Multiple Vulnerabilities Addressed
Summary
RHSA-2026:42899: Red Hat Security Advisory: java-25-openjdk security update. Affects java-25-openjdk versions < 1:25.0.4.0.7-1.1.el10_2. Fixed in 1:25.0.4.0.7-1.1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Java 25 OpenJDK is an open-source implementation of the Java Platform, Standard Edition. It provides a robust environment for developing and running Java applications. This package is widely used in enterprise environments for its reliability and performance. However, recent vulnerabilities have been identified that could potentially compromise the security of applications relying on this package.
Vulnerability Detail
The vulnerabilities identified in Java 25 OpenJDK include multiple CVEs (CVE-2026-41254, CVE-2026-46917, CVE-2026-46968, CVE-2026-47010, CVE-2026-47021, CVE-2026-47027, CVE-2026-47059, CVE-2026-47063, CVE-2026-60147). These vulnerabilities stem from improper input validation and memory management issues, which could allow an attacker to execute arbitrary code, leading to potential data breaches or system compromises. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1:25.0.4.0.7-1.1.el10_2
This is the first release that contains the fix.
sudo dnf update java-25-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the affected systems and monitoring for any unusual activity until the package can be updated. Additionally, review application logs for any signs of exploitation.
Conclusion
In summary, the Java 25 OpenJDK package has critical vulnerabilities that require immediate attention. Updating to the latest patched version is essential to mitigate risks. Utilize tools like Vulert for ongoing monitoring and vulnerability management.
See every vulnerability recorded for java-25-openjdk →
FAQ
The vulnerabilities could allow attackers to execute arbitrary code, potentially leading to unauthorized access and data breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If immediate updates are not possible, implement access restrictions and closely monitor system activity for any signs of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for java-25-openjdk.
