RHSA-2026:94499
Vulnerability from csaf_redhat - Published: 2026-11-05 18:02 - Updated: 2026-11-06 07:28Summary
Red Hat Security Advisory: OpenJDK 11.0.33 ELS Security Update For Portable Linux Builds
Severity
Critical
Notes
Topic: An update is now available for OpenJDK.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The OpenJDK 11 ELS packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.
This release of the Red Hat build of OpenJDK 11 (11.0.33) with Extended Lifecycle Support for portable Linux serves as a replacement for the Red Hat build of OpenJDK 11 (11.0.32.1) and includes security and bug fixes as well as enhancements. For further information, refer to the release notes linked to in the References section.
Security Fix(es):
* java-11-openjdk: Enhance C2 comparisons (Oracle CPU 2026-10) (CVE-2026-91487)
* java-11-openjdk: Enhance MIDI file handling (Oracle CPU 2026-10) (CVE-2026-91400)
* java-11-openjdk: Enhance JShell (Oracle CPU 2026-10) (CVE-2026-91379)
* java-11-openjdk: Enhance TLS Extensions (Oracle CPU 2026-10) (CVE-2026-91461)
* java-11-openjdk: Enhance Preferences (Oracle CPU 2026-10) (CVE-2026-91380)
* java-11-openjdk: Enhance JGSS (Oracle CPU 2026-10) (CVE-2026-91411)
* java-11-openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10) (CVE-2026-91397)
* java-11-openjdk: Enhance SASL Authentication (Oracle CPU 2026-10) (CVE-2026-83381)
* java-11-openjdk: Enhance HTTP Client (Oracle CPU 2026-10) (CVE-2026-91332)
* java-11-openjdk: Improve HTTP headers (Oracle CPU 2026-10) (CVE-2026-91453)
* java-11-openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10) (CVE-2026-101516)
* java-11-openjdk: Improve Pack200 handling (Oracle CPU 2026-10) (CVE-2026-91396)
* java-11-openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10) (CVE-2026-83395)
* java-11-openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10) (CVE-2026-91451)
* java-11-openjdk: Enhance WebRowSets (Oracle CPU 2026-10) (CVE-2026-83387)
* java-11-openjdk: Enhance HTTP server (Oracle CPU 2026-10) (CVE-2026-91452)
* java-11-openjdk: Enhance krb5 tokens (Oracle CPU 2026-10) (CVE-2026-91462)
* java-11-openjdk: Enhance Network Clients (Oracle CPU 2026-10) (CVE-2026-87292)
* java-11-openjdk: Enhance TLS handshakes (Oracle CPU 2026-10) (CVE-2026-91373)
* java-11-openjdk: Enhance Pack200 unpacking (Oracle CPU 2026-10) (CVE-2026-91395)
* java-11-openjdk: Enhance zipfs (Oracle CPU 2026-10) (CVE-2026-91410)
* java-11-openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10) (CVE-2026-83376)
* java-11-openjdk: Enhance font rendering (Oracle CPU 2026-10) (CVE-2026-91415)
* java-11-openjdk: Enhance LDAP logins (Oracle CPU 2026-10) (CVE-2026-83380)
* java-11-openjdk: Enhance Template Handling (Oracle CPU 2026-10) (CVE-2026-87367)
* java-11-openjdk: Enhance jstatd (Oracle CPU 2026-10) (CVE-2026-91374)
* java-11-openjdk: Enhance Image Handling (Oracle CPU 2026-10) (CVE-2026-91335)
* java-11-openjdk: Enhance JPEG loading (Oracle CPU 2026-10) (CVE-2026-91334)
* java-11-openjdk: Enhance Image Processing (Oracle CPU 2026-10) (CVE-2026-91382)
* java-11-openjdk: Enhance GIF loading (Oracle CPU 2026-10) (CVE-2026-91418)
* java-11-openjdk: Enhance XML Processing (Oracle CPU 2026-10) (CVE-2026-83400)
* java-11-openjdk: Enhance Kerberos validation (Oracle CPU 2026-10) (CVE-2026-91464)
* java-11-openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10) (CVE-2026-91398)
* java-11-openjdk: Enhance XPath Expressions (Oracle CPU 2026-10) (CVE-2026-87290)
* java-11-openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10) (CVE-2026-83374)
* java-11-openjdk: Enhance krb5 client (Oracle CPU 2026-10) (CVE-2026-91463)
* java-11-openjdk: Enhance jmod handling (Oracle CPU 2026-10) (CVE-2026-91375)
* java-11-openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10) (CVE-2026-87294)
* java-11-openjdk: Enhance HTTP client caching (Oracle CPU 2026-10) (CVE-2026-91394)
* java-11-openjdk: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-91403)
* java-11-openjdk: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114820)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by sending crafted requests across network protocols to exposed application programming interfaces (APIs) within the Security component. A successful attack can result in unauthorized modification, creation, or deletion of critical application data. In addition, the flaw may allow untrusted code running in a restricted sandbox environment to tamper with protected data.
5.9 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
OPENJDK ELS 11.0.33
Red Hat / Red Hat OpenJDK
|
cpe:/a:redhat:openjdk_els:11
|
— |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in the Java Secure Socket Extension (JSSE) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability over a Transport Layer Security (TLS) connection to perform unauthorized modification, insertion, or deletion of accessible data. Exploitation occurs when network services or applications process untrusted network input through affected JSSE APIs, compromising data integrity.
CWE-295 - Improper Certificate ValidationAffected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Low
A flaw was found in OpenJDK within the Java Authentication and Authorization Service (JAAS) component. An unauthenticated remote attacker can exploit this vulnerability over a network by sending data to affected application programming interfaces (APIs). Successful exploitation results in information disclosure, granting unauthorized read access to a subset of accessible data.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in OpenJDK. An unauthenticated remote attacker can exploit this vulnerability over a network by supplying crafted input to Application Programming Interfaces (APIs) within the Security component. Successful exploitation can result in unauthorized read and modification access to a subset of data accessible to the application.
4.8 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in the Java Database Connectivity (JDBC) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to exposed JDBC application programming interfaces (APIs) or by executing untrusted code. If successfully exploited, this flaw allows an attacker to obtain unauthorized access to critical data, leading to information disclosure.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in OpenJDK. An unauthenticated remote attacker with network access could exploit this vulnerability by submitting crafted data to networking application programming interfaces (APIs). A successful attack could allow unauthorized modification or deletion of accessible data, or result in a partial Denial of Service (DoS).
CWE-444 - Inconsistent Interpretation of HTTP RequestsAffected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in the Java API for XML Processing (JAXP) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting crafted data across the network to applications that expose JAXP interfaces, such as through a web service. Successful exploitation can result in a partial Denial of Service (DoS), reducing the availability of the application.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in the Java API for XML Processing (JAXP) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to applications or web services that rely on vulnerable JAXP APIs. Successful exploitation can result in unauthorized information disclosure, allowing an attacker to access sensitive data managed by the Java application.
CWE-91 - XML InjectionAffected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in the OpenJDK networking component. This vulnerability may allow an unauthenticated remote attacker to cause unauthorized data modification. By supplying crafted input to exposed networking application programming interfaces (APIs), such as through a web service, an attacker can insert, update, or delete a subset of accessible data.
CWE-93 - Improper Neutralization of CRLF SequencesAffected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Low
A flaw was found in OpenJDK. An unauthenticated remote attacker can exploit this issue across multiple network protocols by submitting crafted requests to application programming interfaces (APIs) within the Security component. Successful exploitation allows an attacker to modify or delete accessible application data, as well as gain unauthorized read access to sensitive information.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in the JAXP (Java API for XML Processing) component of OpenJDK. An unauthenticated remote attacker can exploit this vulnerability by providing crafted input to applications or web services that process data through JAXP APIs. Successful exploitation allows the attacker to perform unauthorized data modifications, including updating, inserting, or deleting accessible data.
CWE-91 - XML InjectionAffected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Low
A flaw was found in OpenJDK's Networking component. An unauthenticated remote attacker with network access can exploit this vulnerability by sending crafted input to exposed networking Application Programming Interfaces (APIs). Successful exploitation allows the attacker to perform unauthorized data modifications, potentially inserting, altering, or deleting accessible application data.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in OpenJDK's ImageIO component. This vulnerability allows an unauthenticated remote attacker to cause information disclosure by submitting crafted inputs to applications or web services using the ImageIO application programming interface (API). Successful exploitation can result in unauthorized read access to a subset of accessible data.
CWE-125 - Out-of-bounds ReadAffected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Low
A flaw was found in OpenJDK's Abstract Window Toolkit (AWT). A remote attacker with low privileges could exploit this vulnerability by convincing a user to run untrusted code within a sandboxed environment. Successful exploitation allows unauthorized read access to a subset of accessible data, leading to information disclosure.
CWE-653 - Improper Isolation or CompartmentalizationAffected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Low
A flaw was found in OpenJDK's Java Secure Socket Extension (JSSE) component. An unauthenticated remote attacker with network access via Transport Layer Security (TLS) can exploit this vulnerability to cause a partial Denial of Service (DoS). This issue can be triggered when an application or web service processes untrusted network data using the affected JSSE APIs.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in the Serviceability component of OpenJDK. An unauthenticated remote attacker can exploit this issue across the network by supplying crafted data to exposed application programming interfaces (APIs) or by running untrusted code within a sandboxed Java environment. Successful exploitation may lead to unauthorized data access, allowing the attacker to read and modify sensitive application data.
4.8 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in openjdk. An unauthenticated attacker with local access to the host system could leverage this vulnerability in the Libraries component by convincing a user to interact with a malicious application or by supplying crafted input through exposed application programming interfaces (APIs). Successful exploitation allows the attacker to compromise data integrity, resulting in the unauthorized modification, creation, or deletion of critical data accessible to the Java runtime environment.
4.7 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in OpenJDK's JDK tools component. An unauthenticated local attacker can exploit this vulnerability by convincing a user to interact with untrusted code in an environment relying on the Java security sandbox. A successful attack can result in unauthorized creation, modification, or deletion of critical data accessible to the application.
4.7 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in the OpenJDK Utility component. An unauthenticated attacker with local system access or the ability to supply data to affected application programming interfaces (APIs) can exploit this vulnerability. Successful exploitation can result in unauthorized data access, allowing an attacker to read confidential information as well as modify or delete application data.
4.0 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in OpenJDK's 2D component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted data to an application that processes input using affected 2D APIs. Successful exploitation could allow the attacker to create, modify, or delete accessible data and cause a partial Denial of Service (DoS).
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in the OpenJDK Networking component. This vulnerability allows an unauthenticated remote attacker with network access to cause an information disclosure. By supplying crafted input to networking Application Programming Interfaces (APIs), such as through an exposed web service, an attacker could exploit this flaw to gain unauthorized access to critical data.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in the Utility component of Java SE and GraalVM. An unauthenticated remote attacker with network access could exploit this vulnerability by submitting crafted data to exposed application programming interfaces (APIs). A successful attack allows unauthorized modification or deletion of accessible data and can result in a partial Denial of Service (DoS).
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in the Utility component of OpenJDK. An unauthenticated remote attacker can exploit this vulnerability by supplying untrusted data to component APIs over the network. A successful attack can allow unauthorized modification or deletion of accessible data and cause a partial Denial of Service (DoS).
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in OpenJDK's Serviceability component. An unauthenticated attacker with local access to the host system can exploit this vulnerability with user interaction, such as by supplying crafted input to Serviceability application programming interfaces (APIs). A successful attack can result in unauthorized modification or deletion of accessible data, as well as cause a partial Denial of Service (DoS).
CWE-488 - Exposure of Data Element to Wrong SessionAffected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Low
A flaw was found in OpenJDK. An unauthenticated remote attacker with network access can exploit this vulnerability through the SOCKS5 (Socket Secure) networking protocol to compromise data integrity. Successful exploitation allows unauthorized creation, modification, or deletion of application data and can extend beyond the Java environment to impact related systems.
6.8 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in the Sound component of Java SE and GraalVM. This issue allows an unauthenticated remote attacker to cause a partial Denial of Service (DoS) by convincing a user to run untrusted code within a sandboxed Java environment.
CWE-770 - Allocation of Resources Without Limits or ThrottlingAffected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Low
The certificate authority (CA) store used in OpenJDK and Oracle Java included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL Java client applications and cause such applications to connect to malicious sites.
6.8 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Critical
A flaw was found in the Libraries component of OpenJDK. An unauthenticated remote attacker with network access can exploit this vulnerability by supplying crafted data to vulnerable application programming interfaces (APIs). Successful exploitation allows the attacker to cause a partial Denial of Service (DoS) of the application or service.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in the Java Generic Security Services (JGSS) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted requests to applications or services utilizing JGSS APIs. A successful attack can cause the application to hang or crash repeatedly, resulting in a Denial of Service (DoS), as well as allow unauthorized modification or deletion of accessible data.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in OpenJDK's 2D component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to exposed application programming interfaces (APIs), such as through a web service or application that processes graphics data. A successful attack primarily allows an attacker to cause a Denial of Service (DoS) by triggering an application hang or crash, while also potentially permitting unauthorized reading or modification of a subset of accessible data.
4.8 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Important
A flaw was found in OpenJDK's ImageIO component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to applications utilizing ImageIO APIs. Successful exploitation can result in a partial Denial of Service (DoS), degrading application availability.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in the Networking component of OpenJDK. This vulnerability allows an unauthenticated remote attacker to cause unauthorized data modification by sending crafted input to exposed Application Programming Interfaces (APIs), such as through web services. Successful exploitation enables an attacker to insert, update, or delete data accessible to the application.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in the Networking component of Oracle Java SE and GraalVM. An unauthenticated remote attacker can exploit this vulnerability by submitting crafted data across the network to exposed application programming interfaces (APIs), such as through a web service. A successful attack can allow an attacker to perform unauthorized modification, insertion, or deletion of accessible data.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in OpenJDK's Lightweight HTTP Server. An unauthenticated remote attacker can exploit this vulnerability over the network by sending crafted requests to exposed server Application Programming Interfaces (APIs). Successful exploitation allows an attacker to perform unauthorized data modifications, potentially inserting, altering, or deleting accessible application data.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in the Java Secure Socket Extension (JSSE) component. An unauthenticated remote attacker could exploit this vulnerability over Transport Layer Security (TLS) by sending crafted data to affected application programming interfaces (APIs). A successful attack allows the attacker to cause unauthorized modification, insertion, or deletion of accessible data.
CWE-358 - Improperly Implemented Security Check for StandardAffected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Low
A flaw was found in the Java Generic Security Services (JGSS) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted requests to exposed application programming interfaces (APIs), such as through a web service. A successful attack allows the unauthorized creation, deletion, or modification of critical data accessible to the application.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in the JGSS (Java Generic Security Services) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code in deployments relying on the Java sandbox. Successful exploitation can result in unauthorized access to sensitive data accessible to the Java environment.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in OpenJDK's Java Generic Security Services (JGSS) component. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code within a sandboxed Java environment. Successful exploitation results in unauthorized information disclosure, allowing the attacker to access sensitive data accessible to the application.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in the OpenJDK Compiler component. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted data to exposed application programming interfaces (APIs), such as through a web service. Successful exploitation could allow the attacker to read, update, or delete a subset of accessible data without authorization.
4.8 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
A flaw was found in the OpenJDK Libraries component. An unauthenticated remote attacker can exploit this vulnerability over a network by submitting crafted data to affected application programming interfaces (APIs), or through sandboxed environments that execute untrusted Java code. Successful exploitation allows the attacker to modify, insert, or delete accessible data, as well as gain unauthorized read access to sensitive information.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Moderate
The certificate authority (CA) store used in OpenJDK and Oracle Java included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL Java client applications and cause such applications to connect to malicious sites.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-83374
Threats
Impact
Critical
References
214 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for OpenJDK.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The OpenJDK 11 ELS packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.\n\nThis release of the Red Hat build of OpenJDK 11 (11.0.33) with Extended Lifecycle Support for portable Linux serves as a replacement for the Red Hat build of OpenJDK 11 (11.0.32.1) and includes security and bug fixes as well as enhancements. For further information, refer to the release notes linked to in the References section.\n\nSecurity Fix(es):\n\n* java-11-openjdk: Enhance C2 comparisons (Oracle CPU 2026-10) (CVE-2026-91487)\n* java-11-openjdk: Enhance MIDI file handling (Oracle CPU 2026-10) (CVE-2026-91400)\n* java-11-openjdk: Enhance JShell (Oracle CPU 2026-10) (CVE-2026-91379)\n* java-11-openjdk: Enhance TLS Extensions (Oracle CPU 2026-10) (CVE-2026-91461)\n* java-11-openjdk: Enhance Preferences (Oracle CPU 2026-10) (CVE-2026-91380)\n* java-11-openjdk: Enhance JGSS (Oracle CPU 2026-10) (CVE-2026-91411)\n* java-11-openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10) (CVE-2026-91397)\n* java-11-openjdk: Enhance SASL Authentication (Oracle CPU 2026-10) (CVE-2026-83381)\n* java-11-openjdk: Enhance HTTP Client (Oracle CPU 2026-10) (CVE-2026-91332)\n* java-11-openjdk: Improve HTTP headers (Oracle CPU 2026-10) (CVE-2026-91453)\n* java-11-openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10) (CVE-2026-101516)\n* java-11-openjdk: Improve Pack200 handling (Oracle CPU 2026-10) (CVE-2026-91396)\n* java-11-openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10) (CVE-2026-83395)\n* java-11-openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10) (CVE-2026-91451)\n* java-11-openjdk: Enhance WebRowSets (Oracle CPU 2026-10) (CVE-2026-83387)\n* java-11-openjdk: Enhance HTTP server (Oracle CPU 2026-10) (CVE-2026-91452)\n* java-11-openjdk: Enhance krb5 tokens (Oracle CPU 2026-10) (CVE-2026-91462)\n* java-11-openjdk: Enhance Network Clients (Oracle CPU 2026-10) (CVE-2026-87292)\n* java-11-openjdk: Enhance TLS handshakes (Oracle CPU 2026-10) (CVE-2026-91373)\n* java-11-openjdk: Enhance Pack200 unpacking (Oracle CPU 2026-10) (CVE-2026-91395)\n* java-11-openjdk: Enhance zipfs (Oracle CPU 2026-10) (CVE-2026-91410)\n* java-11-openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10) (CVE-2026-83376)\n* java-11-openjdk: Enhance font rendering (Oracle CPU 2026-10) (CVE-2026-91415)\n* java-11-openjdk: Enhance LDAP logins (Oracle CPU 2026-10) (CVE-2026-83380)\n* java-11-openjdk: Enhance Template Handling (Oracle CPU 2026-10) (CVE-2026-87367)\n* java-11-openjdk: Enhance jstatd (Oracle CPU 2026-10) (CVE-2026-91374)\n* java-11-openjdk: Enhance Image Handling (Oracle CPU 2026-10) (CVE-2026-91335)\n* java-11-openjdk: Enhance JPEG loading (Oracle CPU 2026-10) (CVE-2026-91334)\n* java-11-openjdk: Enhance Image Processing (Oracle CPU 2026-10) (CVE-2026-91382)\n* java-11-openjdk: Enhance GIF loading (Oracle CPU 2026-10) (CVE-2026-91418)\n* java-11-openjdk: Enhance XML Processing (Oracle CPU 2026-10) (CVE-2026-83400)\n* java-11-openjdk: Enhance Kerberos validation (Oracle CPU 2026-10) (CVE-2026-91464)\n* java-11-openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10) (CVE-2026-91398)\n* java-11-openjdk: Enhance XPath Expressions (Oracle CPU 2026-10) (CVE-2026-87290)\n* java-11-openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10) (CVE-2026-83374)\n* java-11-openjdk: Enhance krb5 client (Oracle CPU 2026-10) (CVE-2026-91463)\n* java-11-openjdk: Enhance jmod handling (Oracle CPU 2026-10) (CVE-2026-91375)\n* java-11-openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10) (CVE-2026-87294)\n* java-11-openjdk: Enhance HTTP client caching (Oracle CPU 2026-10) (CVE-2026-91394)\n* java-11-openjdk: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-91403) \n* java-11-openjdk: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114820) \n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:94499",
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_build_of_openjdk/11/html/release_notes_for_red_hat_build_of_openjdk_11.0.33/index",
"url": "https://docs.redhat.com/en/documentation/red_hat_build_of_openjdk/11/html/release_notes_for_red_hat_build_of_openjdk_11.0.33/index"
},
{
"category": "external",
"summary": "2556709",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556709"
},
{
"category": "external",
"summary": "2556795",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556795"
},
{
"category": "external",
"summary": "2556824",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556824"
},
{
"category": "external",
"summary": "2556837",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556837"
},
{
"category": "external",
"summary": "2556859",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556859"
},
{
"category": "external",
"summary": "2556922",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556922"
},
{
"category": "external",
"summary": "2557007",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557007"
},
{
"category": "external",
"summary": "2557032",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557032"
},
{
"category": "external",
"summary": "2557041",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557041"
},
{
"category": "external",
"summary": "2557047",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557047"
},
{
"category": "external",
"summary": "2557079",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557079"
},
{
"category": "external",
"summary": "2557097",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557097"
},
{
"category": "external",
"summary": "2557110",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557110"
},
{
"category": "external",
"summary": "2557117",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557117"
},
{
"category": "external",
"summary": "2557122",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557122"
},
{
"category": "external",
"summary": "2557195",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557195"
},
{
"category": "external",
"summary": "2557236",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557236"
},
{
"category": "external",
"summary": "2557261",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557261"
},
{
"category": "external",
"summary": "2557356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557356"
},
{
"category": "external",
"summary": "2557385",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557385"
},
{
"category": "external",
"summary": "2557405",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557405"
},
{
"category": "external",
"summary": "2557427",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557427"
},
{
"category": "external",
"summary": "2557443",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557443"
},
{
"category": "external",
"summary": "2557506",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557506"
},
{
"category": "external",
"summary": "2557558",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557558"
},
{
"category": "external",
"summary": "2557564",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557564"
},
{
"category": "external",
"summary": "2557598",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557598"
},
{
"category": "external",
"summary": "2557662",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557662"
},
{
"category": "external",
"summary": "2557665",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557665"
},
{
"category": "external",
"summary": "2557674",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557674"
},
{
"category": "external",
"summary": "2557690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557690"
},
{
"category": "external",
"summary": "2557709",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557709"
},
{
"category": "external",
"summary": "2557711",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557711"
},
{
"category": "external",
"summary": "2557731",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557731"
},
{
"category": "external",
"summary": "2557765",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557765"
},
{
"category": "external",
"summary": "2557780",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557780"
},
{
"category": "external",
"summary": "2557857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557857"
},
{
"category": "external",
"summary": "2557906",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557906"
},
{
"category": "external",
"summary": "2557956",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557956"
},
{
"category": "external",
"summary": "2558584",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558584"
},
{
"category": "external",
"summary": "2560322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560322"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94499.json"
}
],
"title": "Red Hat Security Advisory: OpenJDK 11.0.33 ELS Security Update For Portable Linux Builds",
"tracking": {
"current_release_date": "2026-11-06T07:28:34+00:00",
"generator": {
"date": "2026-11-06T07:28:34+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.4"
}
},
"id": "RHSA-2026:94499",
"initial_release_date": "2026-11-05T18:02:43+00:00",
"revision_history": [
{
"date": "2026-11-05T18:02:43+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-11-05T18:02:43+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-06T07:28:34+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OPENJDK ELS 11.0.33",
"product": {
"name": "OPENJDK ELS 11.0.33",
"product_id": "OPENJDK ELS 11.0.33",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openjdk_els:11"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenJDK"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-83374",
"cwe": {
"id": "CWE-358",
"name": "Improperly Implemented Security Check for Standard"
},
"discovery_date": "2026-10-21T00:27:57.766140+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557765"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by sending crafted requests across network protocols to exposed application programming interfaces (APIs) within the Security component. A successful attack can result in unauthorized modification, creation, or deletion of critical application data. In addition, the flaw may allow untrusted code running in a restricted sandbox environment to tamper with protected data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate impact because exploitation carries high complexity, requiring targeted conditions where an application exposes PKCS#5 cryptographic padding routines directly to unauthenticated network input. In typical Red Hat Enterprise Linux and container deployments, Java applications do not process raw cipher data from untrusted clients without intermediate validation layers or authentication. Furthermore, the scope is limited to data integrity without compromising confidentiality or causing service denial.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-83374"
},
{
"category": "external",
"summary": "RHBZ#2557765",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557765"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-83374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-83374"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83374",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83374"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:23:36.480000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-83376",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-10-21T00:06:18.567183+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557427"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Java Secure Socket Extension (JSSE) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability over a Transport Layer Security (TLS) connection to perform unauthorized modification, insertion, or deletion of accessible data. Exploitation occurs when network services or applications process untrusted network input through affected JSSE APIs, compromising data integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having a Low impact because exploitation requires complex conditions during TLS negotiation and results only in partial integrity compromise, with no loss of confidentiality or system availability. In typical Red Hat Enterprise Linux and OpenJDK deployments, TLS connections utilize standard certificate validation pipelines and trust stores, preventing straightforward or broad exploitation. Consequently, the operational risk in standard environments is minimal.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-83376"
},
{
"category": "external",
"summary": "RHBZ#2557427",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557427"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-83376",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-83376"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83376",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83376"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:23:37.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-83380",
"cwe": {
"id": "CWE-90",
"name": "Improper Neutralization of Special Elements used in an LDAP Query"
},
"discovery_date": "2026-10-21T00:12:11.889139+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557506"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenJDK within the Java Authentication and Authorization Service (JAAS) component. An unauthenticated remote attacker can exploit this vulnerability over a network by sending data to affected application programming interfaces (APIs). Successful exploitation results in information disclosure, granting unauthorized read access to a subset of accessible data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance LDAP logins (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate because exploitation is limited to partial information disclosure without compromising system integrity or service availability. For Red Hat environments, exposure is restricted to applications that accept external user inputs and process them through the OpenJDK JAAS LDAP authentication modules. Workloads that do not utilize JAAS for directory service logins or that sanitize input prior to authentication calls are not exposed to this risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-83380"
},
{
"category": "external",
"summary": "RHBZ#2557506",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557506"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-83380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-83380"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83380",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83380"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:23:38.688000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance LDAP logins (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-83381",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-10-20T23:03:15.841868+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557032"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenJDK. An unauthenticated remote attacker can exploit this vulnerability over a network by supplying crafted input to Application Programming Interfaces (APIs) within the Security component. Successful exploitation can result in unauthorized read and modification access to a subset of data accessible to the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance SASL Authentication (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having a Moderate impact because exploitation demands high complexity, requiring an attacker to target applications that expose specific SASL authentication endpoints or process untrusted authentication exchange data. In standard Red Hat Enterprise Linux server environments, Java services do not inherently expose vulnerable interfaces unless custom applications explicitly invoke the affected Security subsystem APIs. Exploitation cannot achieve full system takeover or complete service denial, restricting the potential consequence to unauthorized read or modification of a limited subset of application data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-83381"
},
{
"category": "external",
"summary": "RHBZ#2557032",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557032"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-83381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-83381"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83381",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83381"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:23:39.066000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance SASL Authentication (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-83387",
"cwe": {
"id": "CWE-611",
"name": "Improper Restriction of XML External Entity Reference"
},
"discovery_date": "2026-10-20T23:12:29.943042+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557122"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Java Database Connectivity (JDBC) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to exposed JDBC application programming interfaces (APIs) or by executing untrusted code. If successfully exploited, this flaw allows an attacker to obtain unauthorized access to critical data, leading to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance WebRowSets (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Moderate because exploitation requires an application to parse untrusted input using specific JDBC WebRowSet XML interfaces or execute untrusted code in a sandboxed environment. In typical enterprise architectures, these specialized APIs are not directly accessible to external, unauthenticated users. Additionally, the flaw is restricted to unauthorized disclosure of data and does not grant system modification or denial-of-service capabilities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-83387"
},
{
"category": "external",
"summary": "RHBZ#2557122",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557122"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-83387",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-83387"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83387",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83387"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:23:41.652000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance WebRowSets (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-83395",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests"
},
"discovery_date": "2026-10-20T23:11:11.725999+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557110"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenJDK. An unauthenticated remote attacker with network access could exploit this vulnerability by submitting crafted data to networking application programming interfaces (APIs). A successful attack could allow unauthorized modification or deletion of accessible data, or result in a partial Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate because successful exploitation requires specific environmental conditions, such as processing untrusted HTTP responses through client networking APIs, and cannot result in arbitrary code execution or unauthorized data exposure. In Red Hat environments, OpenJDK runtimes are exposed when Java applications handle responses from untrusted web endpoints or operate behind intermediary proxies subject to request desynchronization. Workloads that connect only to strictly trusted upstream servers are not exposed to this risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-83395"
},
{
"category": "external",
"summary": "RHBZ#2557110",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557110"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-83395",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-83395"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83395",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83395"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:23:44.691000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-83400",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs"
},
"discovery_date": "2026-10-21T00:23:52.318710+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557690"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Java API for XML Processing (JAXP) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting crafted data across the network to applications that expose JAXP interfaces, such as through a web service. Successful exploitation can result in a partial Denial of Service (DoS), reducing the availability of the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance XML Processing (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate severity because, although remotely exploitable without authentication, the blast radius is confined to a partial denial of service without compromising system confidentiality or integrity. Java applications hosted on Red Hat platforms that parse untrusted XML input via exposed endpoints are potentially susceptible to resource exhaustion. Environments that do not ingest external XML payloads or that restrict access to trusted clients remain unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-83400"
},
{
"category": "external",
"summary": "RHBZ#2557690",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557690"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-83400",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-83400"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-83400",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83400"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:23:46.645000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance XML Processing (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-87290",
"cwe": {
"id": "CWE-91",
"name": "XML Injection"
},
"discovery_date": "2026-10-21T00:26:09.025376+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557731"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Java API for XML Processing (JAXP) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to applications or web services that rely on vulnerable JAXP APIs. Successful exploitation can result in unauthorized information disclosure, allowing an attacker to access sensitive data managed by the Java application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance XPath Expressions (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux and Red Hat OpenJDK distributions because exploitation depends on high attack complexity, requiring specific conditions where applications handle untrusted external XML data using vulnerable JAXP XPath evaluation routines. Standard installations do not expose these interfaces directly to the network without custom application logic or specific web services consuming external inputs. Furthermore, the potential impact is constrained to unauthorized information disclosure without enabling arbitrary command execution or system modification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87290"
},
{
"category": "external",
"summary": "RHBZ#2557731",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557731"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87290",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87290"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87290",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87290"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:23:51.453000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance XPath Expressions (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-87292",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences"
},
"discovery_date": "2026-10-20T23:53:30.411856+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557261"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the OpenJDK networking component. This vulnerability may allow an unauthenticated remote attacker to cause unauthorized data modification. By supplying crafted input to exposed networking application programming interfaces (APIs), such as through a web service, an attacker can insert, update, or delete a subset of accessible data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance Network Clients (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this vulnerability as Low impact due to the high attack complexity required to manipulate network client interactions and the absence of confidentiality or availability consequences. Exploitation requires an application to pass unsanitized input directly into networking client interfaces or execute untrusted sandboxed code, scenarios that are atypical in enterprise deployments. As a result, potential exposure is restricted to limited unauthorized data modifications under specialized execution conditions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87292"
},
{
"category": "external",
"summary": "RHBZ#2557261",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557261"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87292",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87292"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87292",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87292"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:23:52.207000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openjdk: Enhance Network Clients (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-87294",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-10-21T00:36:03.345990+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557906"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenJDK. An unauthenticated remote attacker can exploit this issue across multiple network protocols by submitting crafted requests to application programming interfaces (APIs) within the Security component. Successful exploitation allows an attacker to modify or delete accessible application data, as well as gain unauthorized read access to sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate because, although it can be triggered over the network without authentication, the scope of impact is restricted to partial confidentiality and integrity compromise of data handled by the running Java process rather than complete system takeover. Enterprise deployments of Red Hat products running OpenJDK services are primarily at risk when applications process untrusted network traffic and rely on the core Security component for certificate name verification. Applications that do not accept external connections or perform custom certificate validation remain unaffected by this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87294"
},
{
"category": "external",
"summary": "RHBZ#2557906",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557906"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87294",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87294"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87294",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87294"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:23:52.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-87367",
"cwe": {
"id": "CWE-91",
"name": "XML Injection"
},
"discovery_date": "2026-10-21T00:16:13.349275+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557558"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the JAXP (Java API for XML Processing) component of OpenJDK. An unauthenticated remote attacker can exploit this vulnerability by providing crafted input to applications or web services that process data through JAXP APIs. Successful exploitation allows the attacker to perform unauthorized data modifications, including updating, inserting, or deleting accessible data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance Template Handling (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Low severity because successful exploitation requires high complexity and specially constructed input to JAXP template processing APIs, resulting in limited integrity impact without compromising confidentiality or service availability. In Red Hat Enterprise Linux and containerized OpenJDK environments, exposure is restricted to applications that accept untrusted XML or template data without adequate validation. General Java workloads that do not parse external template content remain unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-87367"
},
{
"category": "external",
"summary": "RHBZ#2557558",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557558"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-87367",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-87367"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-87367",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87367"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:24:19.687000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openjdk: Enhance Template Handling (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests"
},
"discovery_date": "2026-10-20T23:04:12.620420+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557041"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenJDK\u0027s Networking component. An unauthenticated remote attacker with network access can exploit this vulnerability by sending crafted input to exposed networking Application Programming Interfaces (APIs). Successful exploitation allows the attacker to perform unauthorized data modifications, potentially inserting, altering, or deleting accessible application data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance HTTP Client (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate severity because, while it can be exploited remotely without privileges, the impact is confined to low integrity compromise without affecting system confidentiality or availability. The issue resides within OpenJDK\u0027s modern HTTP client stack, affecting Java applications that communicate with untrusted servers or through intermediate proxies. Deployments running OpenJDK 8 are not vulnerable because the affected HTTP client codebase is not present.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91332"
},
{
"category": "external",
"summary": "RHBZ#2557041",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557041"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91332"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:25:21.977000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance HTTP Client (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91334",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-10-21T00:22:15.799669+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557662"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenJDK\u0027s ImageIO component. This vulnerability allows an unauthenticated remote attacker to cause information disclosure by submitting crafted inputs to applications or web services using the ImageIO application programming interface (API). Successful exploitation can result in unauthorized read access to a subset of accessible data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance JPEG loading (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Low impact for Red Hat products because successful exploitation requires high attack complexity and only enables unauthorized exposure of limited process memory, with no impact on data integrity or availability. Within Red Hat deployments, exposure is confined to Java applications that specifically ingest and decode untrusted graphic streams using the ImageIO subsystem. Workloads that do not process untrusted image files are not exposed to this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91334"
},
{
"category": "external",
"summary": "RHBZ#2557662",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557662"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91334",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91334"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91334",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91334"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:25:22.651000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openjdk: Enhance JPEG loading (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91335",
"cwe": {
"id": "CWE-653",
"name": "Improper Isolation or Compartmentalization"
},
"discovery_date": "2026-10-21T00:18:28.666628+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557598"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenJDK\u0027s Abstract Window Toolkit (AWT). A remote attacker with low privileges could exploit this vulnerability by convincing a user to run untrusted code within a sandboxed environment. Successful exploitation allows unauthorized read access to a subset of accessible data, leading to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance Image Handling (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is evaluated as having a Low severity impact because exploitation requires complex prerequisites, including user interaction and authenticated access to an untrusted execution environment. Standard deployments across Red Hat Enterprise Linux and enterprise runtimes run only trusted server-side workloads rather than sandboxed client applications. Consequently, default production systems do not expose this attack vector, restricting the risk of unauthorized data disclosure to non-standard client configurations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91335"
},
{
"category": "external",
"summary": "RHBZ#2557598",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557598"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91335",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91335"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91335",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91335"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:25:22.996000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openjdk: Enhance Image Handling (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91373",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-21T00:01:44.146025+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557356"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenJDK\u0027s Java Secure Socket Extension (JSSE) component. An unauthenticated remote attacker with network access via Transport Layer Security (TLS) can exploit this vulnerability to cause a partial Denial of Service (DoS). This issue can be triggered when an application or web service processes untrusted network data using the affected JSSE APIs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance TLS handshakes (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this vulnerability as Moderate because it allows an unauthenticated network-adjacent or remote attacker to cause resource consumption resulting only in partial service degradation, rather than total denial of service or arbitrary code execution. Within Red Hat Enterprise Linux and containerized environments, exposure is restricted to Java workloads actively terminating TLS traffic using JSSE APIs. Confidentiality and data integrity remain unaffected, as the flaw does not facilitate unauthorized access to sensitive information or memory corruption.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91373"
},
{
"category": "external",
"summary": "RHBZ#2557356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91373",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91373"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91373",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91373"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:25:36.496000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance TLS handshakes (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91374",
"cwe": {
"id": "CWE-749",
"name": "Exposed Dangerous Method or Function"
},
"discovery_date": "2026-10-21T00:16:49.118613+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557564"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Serviceability component of OpenJDK. An unauthenticated remote attacker can exploit this issue across the network by supplying crafted data to exposed application programming interfaces (APIs) or by running untrusted code within a sandboxed Java environment. Successful exploitation may lead to unauthorized data access, allowing the attacker to read and modify sensitive application data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance jstatd (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is evaluated as having a Moderate impact for Red Hat Enterprise Linux and OpenJDK environments because successful exploitation requires high attack complexity, such as untrusted sandboxed execution or network exposure of internal serviceability endpoints. In standard Red Hat deployments, diagnostic and serviceability tools are not active by default, and typical workloads do not expose these interfaces to unauthenticated network actors. Furthermore, the maximum impact is constrained to partial data disclosure and modification, without causing service disruption or providing full system compromise.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91374"
},
{
"category": "external",
"summary": "RHBZ#2557564",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557564"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91374"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91374",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91374"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:25:36.857000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance jstatd (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91375",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory"
},
"discovery_date": "2026-10-21T00:33:06.264015+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557857"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in openjdk. An unauthenticated attacker with local access to the host system could leverage this vulnerability in the Libraries component by convincing a user to interact with a malicious application or by supplying crafted input through exposed application programming interfaces (APIs). Successful exploitation allows the attacker to compromise data integrity, resulting in the unauthorized modification, creation, or deletion of critical data accessible to the Java runtime environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance jmod handling (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having a Moderate impact for Red Hat deployments because exploitation requires high attack complexity, local access, and user interaction, while the impact is strictly confined to data integrity. In typical enterprise environments, OpenJDK applications do not routinely process untrusted module archives unless explicitly architected to ingest external jmod files or untrusted input via exposed application interfaces. Furthermore, earlier runtimes such as OpenJDK 8 do not include modular runtime archive features and are unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91375"
},
{
"category": "external",
"summary": "RHBZ#2557857",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557857"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91375"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91375",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91375"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:25:37.216000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance jmod handling (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91379",
"cwe": {
"id": "CWE-653",
"name": "Improper Isolation or Compartmentalization"
},
"discovery_date": "2026-10-20T22:45:57.814362+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556824"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenJDK\u0027s JDK tools component. An unauthenticated local attacker can exploit this vulnerability by convincing a user to interact with untrusted code in an environment relying on the Java security sandbox. A successful attack can result in unauthorized creation, modification, or deletion of critical data accessible to the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance JShell (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate rather than Important because exploitation requires local access, user cooperation, and reliance on Java security sandbox boundaries to constrain untrusted code. Red Hat Enterprise Linux deployments predominantly run server-side Java applications that execute only administrator-provisioned trusted bytecode. Because standard production workflows do not process unvetted scripts through interactive JDK tools such as JShell, most enterprise installations are not exposed to this issue under default operations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91379"
},
{
"category": "external",
"summary": "RHBZ#2556824",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556824"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91379"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91379",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91379"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:25:38.600000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance JShell (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91380",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory"
},
"discovery_date": "2026-10-20T22:48:13.943380+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556859"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the OpenJDK Utility component. An unauthenticated attacker with local system access or the ability to supply data to affected application programming interfaces (APIs) can exploit this vulnerability. Successful exploitation can result in unauthorized data access, allowing an attacker to read confidential information as well as modify or delete application data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance Preferences (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat products because exploitation requires local access or direct exposure of vulnerable Preferences APIs to untrusted input, combined with high execution complexity that limits impact to partial confidentiality and integrity loss. In typical Red Hat Enterprise Linux and containerized Java deployments, applications rarely expose the underlying utility interfaces directly to unauthenticated external actors. Consequently, system-level compromise is not possible, and any potential threat remains restricted to the boundaries of the executing Java runtime process.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91380"
},
{
"category": "external",
"summary": "RHBZ#2556859",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556859"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91380"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91380",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91380"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:25:38.943000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance Preferences (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91382",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-10-21T00:22:23.378283+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557665"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenJDK\u0027s 2D component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted data to an application that processes input using affected 2D APIs. Successful exploitation could allow the attacker to create, modify, or delete accessible data and cause a partial Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance Image Processing (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is classified as Moderate severity because successful exploitation demands high attack complexity, requiring an application to expose endpoints that feed untrusted graphical assets into OpenJDK 2D processing routines. In standard Red Hat Enterprise Linux deployments, Java applications are not broadly exposed unless services explicitly accept and render external image data without prior validation. Because the flaw cannot be leveraged to read confidential system memory or achieve arbitrary remote command execution, the impact remains limited to data tampering and partial service disruption within the executing runtime process.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91382"
},
{
"category": "external",
"summary": "RHBZ#2557665",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557665"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91382"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91382",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91382"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:25:39.637000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance Image Processing (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91394",
"cwe": {
"id": "CWE-524",
"name": "Use of Cache Containing Sensitive Information"
},
"discovery_date": "2026-10-21T00:41:14.425071+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557956"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the OpenJDK Networking component. This vulnerability allows an unauthenticated remote attacker with network access to cause an information disclosure. By supplying crafted input to networking Application Programming Interfaces (APIs), such as through an exposed web service, an attacker could exploit this flaw to gain unauthorized access to critical data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance HTTP client caching (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having a Moderate severity rather than Important due to the high attack complexity required for successful exploitation. While unauthenticated remote callers could potentially trigger information exposure, exploitation hinges on target applications passing untrusted input directly into internal OpenJDK HTTP client caching routines. Workloads that do not process untrusted network requests through affected caching APIs are not exposed to this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91394"
},
{
"category": "external",
"summary": "RHBZ#2557956",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557956"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91394",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91394"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91394",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91394"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:25:44.100000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance HTTP client caching (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91395",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory"
},
"discovery_date": "2026-10-21T00:03:40.004544+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557385"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Utility component of Java SE and GraalVM. An unauthenticated remote attacker with network access could exploit this vulnerability by submitting crafted data to exposed application programming interfaces (APIs). A successful attack allows unauthorized modification or deletion of accessible data and can result in a partial Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance Pack200 unpacking (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is evaluated as a Moderate severity flaw for Red Hat products because exploitation requires an application to actively process untrusted archives using the Pack200 unpacking mechanism, and confidentiality is not compromised. Successful exploitation is limited to unauthorized file manipulation or partial service disruption within the operating context and system privileges granted to the Java process. Modern Java releases are not susceptible, as Pack200 support was removed in Java 14 and later, restricting exposure to legacy OpenJDK 8 and 11 runtimes handling untrusted data.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91395"
},
{
"category": "external",
"summary": "RHBZ#2557385",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557385"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91395",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91395"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91395",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91395"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:25:44.460000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance Pack200 unpacking (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91396",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory"
},
"discovery_date": "2026-10-20T23:09:56.542134+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557097"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Utility component of OpenJDK. An unauthenticated remote attacker can exploit this vulnerability by supplying untrusted data to component APIs over the network. A successful attack can allow unauthorized modification or deletion of accessible data and cause a partial Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Improve Pack200 handling (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Moderate because triggering the issue requires a Java application to process untrusted archive data through Pack200 utilities, confining the impact to unauthorized modification of process-accessible files and partial service interruption without exposing confidential system information. In standard enterprise deployments, applications rarely expose archive unpacking routines directly to unauthenticated network clients, mitigating broad exposure. Additionally, the vulnerability is limited to legacy Java environments that retain Pack200 support, as the feature was removed in later OpenJDK releases.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91396"
},
{
"category": "external",
"summary": "RHBZ#2557097",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557097"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91396",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91396"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91396",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91396"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:25:44.803000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Improve Pack200 handling (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91397",
"cwe": {
"id": "CWE-488",
"name": "Exposure of Data Element to Wrong Session"
},
"discovery_date": "2026-10-20T22:59:49.519270+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557007"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenJDK\u0027s Serviceability component. An unauthenticated attacker with local access to the host system can exploit this vulnerability with user interaction, such as by supplying crafted input to Serviceability application programming interfaces (APIs). A successful attack can result in unauthorized modification or deletion of accessible data, as well as cause a partial Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having a Low impact because exploitation is constrained to local environments and necessitates both high execution complexity and specific user interaction. In typical server and container deployments running OpenJDK on Red Hat Enterprise Linux, the serviceability diagnostic interface is not directly exposed to untrusted users. Consequently, any potential unauthorized data alteration or localized denial of service carries a limited blast radius under standard operational conditions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91397"
},
{
"category": "external",
"summary": "RHBZ#2557007",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557007"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91397"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91397",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91397"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:25:45.159000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 3.6,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91398",
"cwe": {
"id": "CWE-358",
"name": "Improperly Implemented Security Check for Standard"
},
"discovery_date": "2026-10-21T00:24:59.058513+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557711"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenJDK. An unauthenticated remote attacker with network access can exploit this vulnerability through the SOCKS5 (Socket Secure) networking protocol to compromise data integrity. Successful exploitation allows unauthorized creation, modification, or deletion of application data and can extend beyond the Java environment to impact related systems.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Moderate severity for Red Hat products because exploitation requires complex conditions involving specific SOCKS5 proxy protocol handling and does not directly lead to unauthorized disclosure of confidential information or denial of service. In typical Red Hat Enterprise Linux and containerized deployments, Java runtime environments do not commonly rely on SOCKS5 proxies across untrusted network perimeters. The risk is largely confined to specific architectures where applications explicitly establish SOCKS5 connections with untrusted intermediary proxies or accept arbitrary proxy configuration parameters from untrusted actors.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91398"
},
{
"category": "external",
"summary": "RHBZ#2557711",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557711"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91398"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91398",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91398"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:25:45.513000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91400",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-20T22:35:48.178085+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556795"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Sound component of Java SE and GraalVM. This issue allows an unauthenticated remote attacker to cause a partial Denial of Service (DoS) by convincing a user to run untrusted code within a sandboxed Java environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Low severity because exploitation requires user interaction to parse malicious input and is restricted to causing a partial denial of service. OpenJDK environments on Red Hat Enterprise Linux are primarily deployed for server-side workloads executing trusted applications rather than sandboxed client applets. As a result, standard deployments that do not load or process untrusted multimedia sound resources are not exposed to significant operational risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91400"
},
{
"category": "external",
"summary": "RHBZ#2556795",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556795"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91400",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91400"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91400",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91400"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:25:46.374000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91403",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-10-21T21:44:33.921248+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2558584"
}
],
"notes": [
{
"category": "description",
"text": "The certificate authority (CA) store used in OpenJDK and Oracle Java included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL Java client applications and cause such applications to connect to malicious sites.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The OpenJDK RPM packages in Red Hat Enterprise Linux do not include their own CA certificate bundle and instead rely on ca-certificates packages for their default CA certificate store. Therefore, those OpenJDK versions require an updated ca-certificates RPM package to be installed to address this issue (refer to CVE-2026-114406 for more details about available ca-certificates package updates).\n\nThe OpenJDK packages in the Red Hat build of OpenJDK product for both Linux and Windows include their own CA certificate store file and therefore need to be updated separately from the ca-certificates updates.\n\nThe certificate bundle used in OpenJDK upstream included root certificates that signed eMudhra intermediate certificates with weak keys. OpenJDK upstream first attempted to address this issue by only blocking problematic intermediate certificates without changing the list of trusted root CAs. CVE-2026-91403 was assigned to that change. However, the fix proved insufficient and easy to bypass; therefore, OpenJDK upstream later removed the relevant root CA certificates, and a new CVE-2026-114820 was assigned to that change.\n\nSince the problem for OpenJDK packages in Red Hat Enterprise Linux was addressed via ca-certificates updates, and the fix applied under this CVE is incorrect, Red Hat does not plan to issue updates for Red Hat Enterprise Linux claiming to address this CVE.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91403"
},
{
"category": "external",
"summary": "RHBZ#2558584",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558584"
},
{
"category": "external",
"summary": "RHSB-2026-012",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-012"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91403"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91403",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91403"
},
{
"category": "external",
"summary": "https://openjdk.org/groups/vulnerability/advisories/2026-10-21",
"url": "https://openjdk.org/groups/vulnerability/advisories/2026-10-21"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/alert-cve-2026-91403.html",
"url": "https://www.oracle.com/security-alerts/alert-cve-2026-91403.html"
}
],
"release_date": "2026-10-21T21:23:28.057000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
},
{
"category": "workaround",
"details": "Users of OpenJDK RPM packages in Red Hat Enterprise Linux can resolve this issue by installing updated ca-certificates packages fixing CVE-2026-114406.\n\nAlso refer to the detailed information in the RHSB-2026-012 security bulletin for other mitigation steps if updating ca-certificates packages is not possible.",
"product_ids": [
"OPENJDK ELS 11.0.33"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns"
},
{
"cve": "CVE-2026-91410",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-10-21T00:04:49.787811+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557405"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Libraries component of OpenJDK. An unauthenticated remote attacker with network access can exploit this vulnerability by supplying crafted data to vulnerable application programming interfaces (APIs). Successful exploitation allows the attacker to cause a partial Denial of Service (DoS) of the application or service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance zipfs (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has evaluated this vulnerability as having a Moderate impact because exploitation is constrained to a partial denial of service without compromising system confidentiality or integrity. Exposure primarily affects Java applications that accept and process untrusted archive data using the internal zipfs file system provider. In typical environments where applications do not expose archive parsing interfaces to untrusted external callers, the operational risk remains limited.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91410"
},
{
"category": "external",
"summary": "RHBZ#2557405",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557405"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91410",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91410"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91410",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91410"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:25:49.138000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance zipfs (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91411",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-10-20T22:52:55.140790+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556922"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Java Generic Security Services (JGSS) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted requests to applications or services utilizing JGSS APIs. A successful attack can cause the application to hang or crash repeatedly, resulting in a Denial of Service (DoS), as well as allow unauthorized modification or deletion of accessible data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance JGSS (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this vulnerability as Moderate impact because successful exploitation demands high attack complexity and only compromises availability and partial integrity without exposing confidential data. The flaw only presents risk to enterprise environments where network services directly pass untrusted authentication tokens or requests into Generic Security Services APIs. Furthermore, default deployments using OpenJDK 17 and OpenJDK 21 across current Red Hat Enterprise Linux releases do not include the vulnerable code, confining risk primarily to legacy Java runtimes.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91411"
},
{
"category": "external",
"summary": "RHBZ#2556922",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556922"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91411"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91411",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91411"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:25:49.588000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance JGSS (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91415",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-21T00:07:18.992619+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557443"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenJDK\u0027s 2D component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to exposed application programming interfaces (APIs), such as through a web service or application that processes graphics data. A successful attack primarily allows an attacker to cause a Denial of Service (DoS) by triggering an application hang or crash, while also potentially permitting unauthorized reading or modification of a subset of accessible data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance font rendering (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because unauthenticated remote threats can cause a full service disruption or compromise memory integrity in workloads utilizing OpenJDK 2D subsystems. In Red Hat Enterprise Linux and container environments, exposure is contingent on whether server applications ingest and render untrusted font or graphical assets. Java workloads that do not process external visual assets or expose rendering interfaces to network callers face minimal practical exposure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91415"
},
{
"category": "external",
"summary": "RHBZ#2557443",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557443"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91415",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91415"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91415",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91415"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:25:50.975000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "openjdk: Enhance font rendering (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91418",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition"
},
"discovery_date": "2026-10-21T00:22:57.705155+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557674"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenJDK\u0027s ImageIO component. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to applications utilizing ImageIO APIs. Successful exploitation can result in a partial Denial of Service (DoS), degrading application availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance GIF loading (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has rated this vulnerability as Moderate because exploitation is limited to causing a partial denial of service, with no potential for unauthorized data disclosure or modification. In Red Hat Enterprise Linux environments, exposure is confined to Java applications that actively parse untrusted image assets through the standard ImageIO APIs. Workloads that do not accept or process external graphic files remain unaffected by this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91418"
},
{
"category": "external",
"summary": "RHBZ#2557674",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557674"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91418",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91418"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91418",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91418"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:25:51.705000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance GIF loading (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91451",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests"
},
"discovery_date": "2026-10-20T23:11:58.335143+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557117"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Networking component of OpenJDK. This vulnerability allows an unauthenticated remote attacker to cause unauthorized data modification by sending crafted input to exposed Application Programming Interfaces (APIs), such as through web services. Successful exploitation enables an attacker to insert, update, or delete data accessible to the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having a Moderate impact because exploitation is constrained to partial integrity loss without allowing unauthorized information disclosure or total denial of service. Within Red Hat environments, the issue primarily threatens Java applications that directly parse untrusted network traffic via built-in HTTP server networking APIs rather than through hardened reverse proxies. Even when successfully triggered by an unauthenticated remote attacker, the exploit cannot achieve arbitrary code execution or elevate privileges on the underlying operating system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91451"
},
{
"category": "external",
"summary": "RHBZ#2557117",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557117"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91451"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91451",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91451"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:26:02.855000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91452",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests"
},
"discovery_date": "2026-10-20T23:44:29.335406+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557195"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Networking component of Oracle Java SE and GraalVM. An unauthenticated remote attacker can exploit this vulnerability by submitting crafted data across the network to exposed application programming interfaces (APIs), such as through a web service. A successful attack can allow an attacker to perform unauthorized modification, insertion, or deletion of accessible data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance HTTP server (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate impact for Red Hat products because, although it can be triggered remotely without authentication or user interaction, successful exploitation is limited to partial data integrity alterations without compromising confidentiality or system availability. Java runtime environments across Red Hat Enterprise Linux and Red Hat OpenJDK distributions are exposed when hosting web applications or network endpoints that parse untrusted requests via built-in HTTP server APIs. Due to inconsistent request processing, an external attacker submitting malformed requests can manipulate accessible data flows, but the flaw does not facilitate arbitrary code execution or broader infrastructure compromise.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91452"
},
{
"category": "external",
"summary": "RHBZ#2557195",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557195"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91452"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91452",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91452"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:26:03.214000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance HTTP server (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91453",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests"
},
"discovery_date": "2026-10-20T23:04:57.893720+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557047"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenJDK\u0027s Lightweight HTTP Server. An unauthenticated remote attacker can exploit this vulnerability over the network by sending crafted requests to exposed server Application Programming Interfaces (APIs). Successful exploitation allows an attacker to perform unauthorized data modifications, potentially inserting, altering, or deleting accessible application data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Improve HTTP headers (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate severity because exploitation requires an application to actively instantiate and expose the embedded OpenJDK lightweight HTTP server to untrusted network traffic, and successful attacks result only in partial integrity compromise without exposing data confidentiality or impacting service availability. OpenJDK packages shipped with Red Hat Enterprise Linux provide this lightweight server API primarily for embedded testing and lightweight standalone utilities rather than general-purpose production web services. Consequently, standard deployments that do not expose custom applications utilizing this specific internal HTTP server interface remain unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91453"
},
{
"category": "external",
"summary": "RHBZ#2557047",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557047"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91453",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91453"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91453",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91453"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:26:03.566000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Improve HTTP headers (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91461",
"cwe": {
"id": "CWE-358",
"name": "Improperly Implemented Security Check for Standard"
},
"discovery_date": "2026-10-20T22:46:53.031979+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556837"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Java Secure Socket Extension (JSSE) component. An unauthenticated remote attacker could exploit this vulnerability over Transport Layer Security (TLS) by sending crafted data to affected application programming interfaces (APIs). A successful attack allows the attacker to cause unauthorized modification, insertion, or deletion of accessible data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance TLS Extensions (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Low severity because successful exploitation requires difficult-to-achieve attack conditions over TLS and produces only limited integrity impact without compromising system confidentiality or service availability. In Red Hat environments, exposure is restricted to Java workloads that expose JSSE endpoints to untrusted network traffic or process malicious handshakes. Standard Red Hat Enterprise Linux deployments do not expose these interfaces by default without explicitly configured network-facing Java services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91461"
},
{
"category": "external",
"summary": "RHBZ#2556837",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556837"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91461",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91461"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91461",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91461"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:26:05.674000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openjdk: Enhance TLS Extensions (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91462",
"cwe": {
"id": "CWE-354",
"name": "Improper Validation of Integrity Check Value"
},
"discovery_date": "2026-10-20T23:49:52.141916+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557236"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Java Generic Security Services (JGSS) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted requests to exposed application programming interfaces (APIs), such as through a web service. A successful attack allows the unauthorized creation, deletion, or modification of critical data accessible to the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance krb5 tokens (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated with a Moderate severity rather than Important because exploitation involves high attack complexity and specifically depends on custom Java deployments exposing JGSS Kerberos token parsing to unauthenticated network input. In standard Red Hat Enterprise Linux environments, OpenJDK provides underlying cryptographic and authentication libraries, but exploitation cannot occur automatically without an application processing untrusted authentication tokens. Additionally, successful exploitation affects data integrity without directly threatening system availability or data confidentiality.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91462"
},
{
"category": "external",
"summary": "RHBZ#2557236",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557236"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91462",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91462"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91462",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91462"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:26:06.021000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance krb5 tokens (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91463",
"cwe": {
"id": "CWE-749",
"name": "Exposed Dangerous Method or Function"
},
"discovery_date": "2026-10-21T00:28:48.205982+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557780"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the JGSS (Java Generic Security Services) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code in deployments relying on the Java sandbox. Successful exploitation can result in unauthorized access to sensitive data accessible to the Java environment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance krb5 client (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Moderate impact because exploitation requires tricking a user into executing untrusted code within an environment that relies on sandbox restrictions, combined with high attack complexity. In typical Red Hat deployments, OpenJDK is utilized for server-side infrastructure and enterprise applications that execute solely trusted code managed by administrators. Because these standard server environments do not rely on the Java security sandbox for isolation, they are not exposed under default operational configurations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91463"
},
{
"category": "external",
"summary": "RHBZ#2557780",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557780"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91463",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91463"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91463",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91463"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:26:06.372000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance krb5 client (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91464",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-10-21T00:24:53.048347+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557709"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenJDK\u0027s Java Generic Security Services (JGSS) component. An unauthenticated remote attacker could exploit this vulnerability by enticing a user to execute untrusted code within a sandboxed Java environment. Successful exploitation results in unauthorized information disclosure, allowing the attacker to access sensitive data accessible to the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance Kerberos validation (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is assessed as Moderate impact because exploitation requires high attack complexity and user interaction to execute untrusted code inside an isolated Java sandbox. In typical Red Hat deployments, OpenJDK powers server-side applications running exclusively trusted administrative code rather than untrusted client applets. As enterprise workloads do not depend on the deprecated Java sandbox mechanisms for security, standard deployments are not exposed to this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91464"
},
{
"category": "external",
"summary": "RHBZ#2557709",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557709"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91464",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91464"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91464",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91464"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:26:06.710000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance Kerberos validation (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-91487",
"cwe": {
"id": "CWE-1025",
"name": "Comparison Using Wrong Factors"
},
"discovery_date": "2026-10-20T22:23:21.307778+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556709"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the OpenJDK Compiler component. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted data to exposed application programming interfaces (APIs), such as through a web service. Successful exploitation could allow the attacker to read, update, or delete a subset of accessible data without authorization.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance C2 comparisons (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated with Moderate impact for Red Hat products because triggering the condition requires high attack complexity, specialized target inputs, and grants only partial read or modification privileges without impacting service availability. In typical enterprise environments running Red Hat OpenJDK, the flaw resides in the JIT compiler during bytecode compilation and cannot be leveraged for arbitrary remote code execution. Exploitation requires an attacker to interact with network services that pass tailored parameters through vulnerable methods, limiting the overall blast radius to the context of the running application.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-91487"
},
{
"category": "external",
"summary": "RHBZ#2556709",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556709"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-91487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-91487"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-91487",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91487"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:26:13.608000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance C2 comparisons (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-101516",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-10-20T23:08:33.332965+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2557079"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the OpenJDK Libraries component. An unauthenticated remote attacker can exploit this vulnerability over a network by submitting crafted data to affected application programming interfaces (APIs), or through sandboxed environments that execute untrusted Java code. Successful exploitation allows the attacker to modify, insert, or delete accessible data, as well as gain unauthorized read access to sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Moderate impact because, while an unauthenticated remote attacker can trigger improper certificate constraint verification through exposed network services or application interfaces, the resulting impact is limited to unauthorized read or modification of a subset of application data without full host compromise or service disruption. In typical Red Hat Enterprise Linux and container environments, OpenJDK runs backend server workloads rather than untrusted client sandboxes like applets or Web Start. Consequently, exploitation is restricted to applications that directly process untrusted certificates or rely on flawed constraint validation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-101516"
},
{
"category": "external",
"summary": "RHBZ#2557079",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2557079"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-101516",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-101516"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-101516",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101516"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpuoct2026.html",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"release_date": "2026-10-20T21:21:18.319000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10)"
},
{
"cve": "CVE-2026-114820",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-10-24T18:50:57.271768+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2560322"
}
],
"notes": [
{
"category": "description",
"text": "The certificate authority (CA) store used in OpenJDK and Oracle Java included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL Java client applications and cause such applications to connect to malicious sites.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The OpenJDK RPM packages in Red Hat Enterprise Linux do not include their own CA certificate bundle and instead rely on ca-certificates packages for their default CA certificate store. Therefore, those OpenJDK versions require an updated ca-certificates RPM package to be installed to address this issue (refer to CVE-2026-114406 for more details about available ca-certificates package updates).\n\nThe OpenJDK packages in the Red Hat build of OpenJDK product for both Linux and Windows include their own CA certificate store file and therefore need to be updated separately from the ca-certificates updates.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OPENJDK ELS 11.0.33"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-114820"
},
{
"category": "external",
"summary": "RHBZ#2560322",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560322"
},
{
"category": "external",
"summary": "RHSB-2026-012",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-012"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-114820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-114820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114820"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/alert-cve-2026-114820.html",
"url": "https://www.oracle.com/security-alerts/alert-cve-2026-114820.html"
}
],
"release_date": "2026-10-24T18:42:04.571000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-05T18:02:43+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"OPENJDK ELS 11.0.33"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:94499"
},
{
"category": "workaround",
"details": "Users of OpenJDK RPM packages in Red Hat Enterprise Linux can resolve this issue by installing updated ca-certificates packages fixing CVE-2026-114406.\n\nAlso refer to the detailed information in the RHSB-2026-012 security bulletin for other mitigation steps if updating ca-certificates packages is not possible.",
"product_ids": [
"OPENJDK ELS 11.0.33"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OPENJDK ELS 11.0.33"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.