Red Hat Product Errata RHSA-2026:89916 - Security Advisory
Issued:
2026-10-27
Updated:
2026-10-27

RHSA-2026:89916 - Security Advisory

Synopsis

Critical: OpenJDK 17.0.21 Security Update for Windows Builds

Type/Severity

Security Advisory: Critical

Topic

An update is now available for OpenJDK.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The OpenJDK 17 packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit.

This release of the Red Hat build of OpenJDK 17 (17.0.21) for Windows serves as a replacement for the Red Hat build of OpenJDK 17 (17.0.20 and 17.0.20.1) and includes security and bug fixes as well as enhancements. For further information, refer to the release notes linked to in the References section.

Security Fix(es):

  • JDK: Enhance PKCS5 padding (CVE-2026-83374)
  • JDK: Enhance TLS certificate handling (CVE-2026-83376)
  • JDK: Enhance LDAP logins (CVE-2026-83380)
  • JDK: Enhance SASL Authentication (CVE-2026-83381)
  • JDK: Enhance WebRowSets (CVE-2026-83387)
  • JDK: Enhance HTTP Client Response Handling (CVE-2026-83395)
  • JDK: Enhance XML Processing (CVE-2026-83400)
  • JDK: Enhance XPath Expressions (CVE-2026-87290)
  • JDK: Enhance Network Clients (CVE-2026-87292)
  • JDK: Enhance Certificate Name Checks (CVE-2026-87294)
  • JDK: Enhance Template Handling (CVE-2026-87367)
  • JDK: Enhance HTTP Client (CVE-2026-91332)
  • JDK: Enhance JPEG loading (CVE-2026-91334)
  • JDK: Enhance Image Handling (CVE-2026-91335)
  • JDK: Enhance TLS handshakes (CVE-2026-91373)
  • JDK: Enhance jstatd (CVE-2026-91374)
  • JDK: Enhance jmod handling (CVE-2026-91375)
  • JDK: Enhance JShell (CVE-2026-91379)
  • JDK: Enhance Preferences (CVE-2026-91380)
  • JDK: Enhance Image Processing (CVE-2026-91382)
  • JDK: Enhance HTTP client caching (CVE-2026-91394)
  • JDK: Enhance diagnostic sessions (CVE-2026-91397)
  • JDK: Enhance SOCKS5 support (CVE-2026-91398)
  • JDK: Enhance MIDI file handling (CVE-2026-91400)
  • JDK: Enhance zipfs (CVE-2026-91410)
  • JDK: Enhance font rendering (CVE-2026-91415)
  • JDK: Enhance GIF loading (CVE-2026-91418)
  • JDK: Enhance HTTP server parsing (CVE-2026-91451)
  • JDK: Enhance HTTP server (CVE-2026-91452)
  • JDK: Improve HTTP headers (CVE-2026-91453)
  • JDK: Enhance TLS Extensions (CVE-2026-91461)
  • JDK: Enhance krb5 tokens (CVE-2026-91462)
  • JDK: Enhance krb5 client (CVE-2026-91463)
  • JDK: Enhance Kerberos validation (CVE-2026-91464)
  • JDK: Enhance C2 comparisons (CVE-2026-91487)
  • JDK: Enhance Certificate Constraint Checking (CVE-2026-101516)
  • JDK: Enhance Image Processing (CVE-2026-91382)
  • JDK: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-91403)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • OpenJDK Java (for Middleware) 1 x86_64

Fixes

  • BZ - 2556709 - CVE-2026-91487 openjdk: Enhance C2 comparisons (Oracle CPU 2026-10)
  • BZ - 2556795 - CVE-2026-91400 openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)
  • BZ - 2556824 - CVE-2026-91379 openjdk: Enhance JShell (Oracle CPU 2026-10)
  • BZ - 2556837 - CVE-2026-91461 openjdk: Enhance TLS Extensions (Oracle CPU 2026-10)
  • BZ - 2556859 - CVE-2026-91380 openjdk: Enhance Preferences (Oracle CPU 2026-10)
  • BZ - 2557007 - CVE-2026-91397 openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10)
  • BZ - 2557032 - CVE-2026-83381 openjdk: Enhance SASL Authentication (Oracle CPU 2026-10)
  • BZ - 2557041 - CVE-2026-91332 openjdk: Enhance HTTP Client (Oracle CPU 2026-10)
  • BZ - 2557047 - CVE-2026-91453 openjdk: Improve HTTP headers (Oracle CPU 2026-10)
  • BZ - 2557079 - CVE-2026-101516 openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10)
  • BZ - 2557110 - CVE-2026-83395 openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10)
  • BZ - 2557117 - CVE-2026-91451 openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10)
  • BZ - 2557122 - CVE-2026-83387 openjdk: Enhance WebRowSets (Oracle CPU 2026-10)
  • BZ - 2557195 - CVE-2026-91452 openjdk: Enhance HTTP server (Oracle CPU 2026-10)
  • BZ - 2557236 - CVE-2026-91462 openjdk: Enhance krb5 tokens (Oracle CPU 2026-10)
  • BZ - 2557261 - CVE-2026-87292 openjdk: Enhance Network Clients (Oracle CPU 2026-10)
  • BZ - 2557356 - CVE-2026-91373 openjdk: Enhance TLS handshakes (Oracle CPU 2026-10)
  • BZ - 2557405 - CVE-2026-91410 openjdk: Enhance zipfs (Oracle CPU 2026-10)
  • BZ - 2557427 - CVE-2026-83376 openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10)
  • BZ - 2557443 - CVE-2026-91415 openjdk: Enhance font rendering (Oracle CPU 2026-10)
  • BZ - 2557506 - CVE-2026-83380 openjdk: Enhance LDAP logins (Oracle CPU 2026-10)
  • BZ - 2557558 - CVE-2026-87367 openjdk: Enhance Template Handling (Oracle CPU 2026-10)
  • BZ - 2557564 - CVE-2026-91374 openjdk: Enhance jstatd (Oracle CPU 2026-10)
  • BZ - 2557598 - CVE-2026-91335 openjdk: Enhance Image Handling (Oracle CPU 2026-10)
  • BZ - 2557662 - CVE-2026-91334 openjdk: Enhance JPEG loading (Oracle CPU 2026-10)
  • BZ - 2557665 - CVE-2026-91382 openjdk: Enhance Image Processing (Oracle CPU 2026-10)
  • BZ - 2557674 - CVE-2026-91418 openjdk: Enhance GIF loading (Oracle CPU 2026-10)
  • BZ - 2557690 - CVE-2026-83400 openjdk: Enhance XML Processing (Oracle CPU 2026-10)
  • BZ - 2557709 - CVE-2026-91464 openjdk: Enhance Kerberos validation (Oracle CPU 2026-10)
  • BZ - 2557711 - CVE-2026-91398 openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10)
  • BZ - 2557731 - CVE-2026-87290 openjdk: Enhance XPath Expressions (Oracle CPU 2026-10)
  • BZ - 2557765 - CVE-2026-83374 openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10)
  • BZ - 2557780 - CVE-2026-91463 openjdk: Enhance krb5 client (Oracle CPU 2026-10)
  • BZ - 2557857 - CVE-2026-91375 openjdk: Enhance jmod handling (Oracle CPU 2026-10)
  • BZ - 2557906 - CVE-2026-87294 openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10)
  • BZ - 2557956 - CVE-2026-91394 openjdk: Enhance HTTP client caching (Oracle CPU 2026-10)
  • BZ - 2558584 - CVE-2026-91403 OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.