alsa-2026:9693
Vulnerability from osv_almalinux
Published
2026-04-22 00:00
Modified
2026-04-24 09:58
Summary
Important: java-25-openjdk security update
Details
The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit.
Security Fix(es):
- JDK: Enhance crypto algorithm support (CVE-2026-22007)
- JDK: Improved Arena allocations (CVE-2026-22008)
- JDK: Improve Kerberos credentialing (CVE-2026-22013)
- JDK: Enhance Path Factories Redux (CVE-2026-22016)
- JDK: Enhance Zip file reading (CVE-2026-22018)
- JDK: Enhance certificate chain validation (CVE-2026-22021)
- JDK: Updating FreeType 2.14.1 (CVE-2026-23865)
- JDK: Enhance TLS connection handling (CVE-2026-34282)
- JDK: Enhance key generation (CVE-2026-34268)
This release also updates a number of third-party libraries included in the JDK. The libraries themselves are affected by the following CVEs, but this is not a statement that the JDK itself is affected:
- giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740)
- libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)
- libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)
Bug Fix(es):
- When copying files, OpenJDK 25 prefers to use the copy_file_range native function for performance reasons, only falling back to sendfile when this fails. However, in previous OpenJDK 25 releases, a response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile. This is rectified in this release. (AlmaLinux-169939, AlmaLinux-169937)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-crypto-adapter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-crypto-adapter-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-crypto-adapter-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-demo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-demo-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-demo-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-devel-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-devel-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-headless"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-headless-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-headless-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-javadoc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-javadoc-zip"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-jmods"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-jmods-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-jmods-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-src"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-src-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-src-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-static-libs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-static-libs-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:10",
"name": "java-25-openjdk-static-libs-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-crypto-adapter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-crypto-adapter-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-crypto-adapter-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-demo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-demo-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-demo-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-devel-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-devel-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-headless"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-headless-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-headless-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-javadoc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-javadoc-zip"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-jmods"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-jmods-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-jmods-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-src"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-src-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-src-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-static-libs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-static-libs-fastdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:9",
"name": "java-25-openjdk-static-libs-slowdebug"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1:25.0.3.0.9-1.el9.alma.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. \n\nSecurity Fix(es): \n\n * JDK: Enhance crypto algorithm support (CVE-2026-22007)\n * JDK: Improved Arena allocations (CVE-2026-22008)\n * JDK: Improve Kerberos credentialing (CVE-2026-22013)\n * JDK: Enhance Path Factories Redux (CVE-2026-22016)\n * JDK: Enhance Zip file reading (CVE-2026-22018)\n * JDK: Enhance certificate chain validation (CVE-2026-22021)\n * JDK: Updating FreeType 2.14.1 (CVE-2026-23865)\n * JDK: Enhance TLS connection handling (CVE-2026-34282)\n * JDK: Enhance key generation (CVE-2026-34268)\n\n\nThis release also updates a number of third-party libraries included in the JDK. The libraries themselves are affected by the following CVEs, but this is not a statement that the JDK itself is affected: \n\n * giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740)\n * libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)\n * libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)\n\n\nBug Fix(es): \n\n * When copying files, OpenJDK 25 prefers to use the copy_file_range native function for performance reasons, only falling back to sendfile when this fails. However, in previous OpenJDK 25 releases, a response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile. This is rectified in this release. (AlmaLinux-169939, AlmaLinux-169937)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
"id": "ALSA-2026:9693",
"modified": "2026-04-24T09:58:24Z",
"published": "2026-04-22T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:9693"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-22007"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-22008"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-22013"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-22016"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-22018"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-22021"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-23865"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-26740"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-33416"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-33636"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-34268"
},
{
"type": "REPORT",
"url": "https://access.redhat.com/security/cve/CVE-2026-34282"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/10/ALSA-2026-9693.html"
},
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/9/ALSA-2026-9693.html"
}
],
"related": [
"CVE-2026-22007",
"CVE-2026-22008",
"CVE-2026-22013",
"CVE-2026-22016",
"CVE-2026-22018",
"CVE-2026-22021",
"CVE-2026-23865",
"CVE-2026-34282",
"CVE-2026-34268",
"CVE-2026-26740",
"CVE-2026-33636",
"CVE-2026-33416"
],
"summary": "Important: java-25-openjdk security update"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…