Red Hat Product Errata RHSA-2026:95273 - Security Advisory
Issued:
2026-11-05
Updated:
2026-11-05

RHSA-2026:95273 - Security Advisory

Synopsis

Critical: OpenJDK 11.0.33 ELS Security Update for Windows Builds

Type/Severity

Security Advisory: Critical

Topic

An update is now available for OpenJDK.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The OpenJDK 11 packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.

This release of the Red Hat build of OpenJDK 11 (11.0.33) with Extended Lifecycle Support for Windows serves as a replacement for the Red Hat build of OpenJDK 11 (11.0.32.1) and includes security and bug fixes as well as enhancements. For further information, refer to the release notes linked to in the References section.

Security Fix(es):

  • java-11-openjdk: Enhance C2 comparisons (Oracle CPU 2026-10) (CVE-2026-91487)
  • java-11-openjdk: Enhance MIDI file handling (Oracle CPU 2026-10) (CVE-2026-91400)
  • java-11-openjdk: Enhance JShell (Oracle CPU 2026-10) (CVE-2026-91379)
  • java-11-openjdk: Enhance TLS Extensions (Oracle CPU 2026-10) (CVE-2026-91461)
  • java-11-openjdk: Enhance Preferences (Oracle CPU 2026-10) (CVE-2026-91380)
  • java-11-openjdk: Enhance JGSS (Oracle CPU 2026-10) (CVE-2026-91411)
  • java-11-openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10) (CVE-2026-91397)
  • java-11-openjdk: Enhance SASL Authentication (Oracle CPU 2026-10) (CVE-2026-83381)
  • java-11-openjdk: Enhance HTTP Client (Oracle CPU 2026-10) (CVE-2026-91332)
  • java-11-openjdk: Improve HTTP headers (Oracle CPU 2026-10) (CVE-2026-91453)
  • java-11-openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10) (CVE-2026-101516)
  • java-11-openjdk: Improve Pack200 handling (Oracle CPU 2026-10) (CVE-2026-91396)
  • java-11-openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10) (CVE-2026-83395)
  • java-11-openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10) (CVE-2026-91451)
  • java-11-openjdk: Enhance WebRowSets (Oracle CPU 2026-10) (CVE-2026-83387)
  • java-11-openjdk: Enhance HTTP server (Oracle CPU 2026-10) (CVE-2026-91452)
  • java-11-openjdk: Enhance krb5 tokens (Oracle CPU 2026-10) (CVE-2026-91462)
  • java-11-openjdk: Enhance Network Clients (Oracle CPU 2026-10) (CVE-2026-87292)
  • java-11-openjdk: Enhance TLS handshakes (Oracle CPU 2026-10) (CVE-2026-91373)
  • java-11-openjdk: Enhance Pack200 unpacking (Oracle CPU 2026-10) (CVE-2026-91395)
  • java-11-openjdk: Enhance zipfs (Oracle CPU 2026-10) (CVE-2026-91410)
  • java-11-openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10) (CVE-2026-83376)
  • java-11-openjdk: Enhance font rendering (Oracle CPU 2026-10) (CVE-2026-91415)
  • java-11-openjdk: Enhance LDAP logins (Oracle CPU 2026-10) (CVE-2026-83380)
  • java-11-openjdk: Enhance Template Handling (Oracle CPU 2026-10) (CVE-2026-87367)
  • java-11-openjdk: Enhance jstatd (Oracle CPU 2026-10) (CVE-2026-91374)
  • java-11-openjdk: Enhance Image Handling (Oracle CPU 2026-10) (CVE-2026-91335)
  • java-11-openjdk: Enhance JPEG loading (Oracle CPU 2026-10) (CVE-2026-91334)
  • java-11-openjdk: Enhance Image Processing (Oracle CPU 2026-10) (CVE-2026-91382)
  • java-11-openjdk: Enhance GIF loading (Oracle CPU 2026-10) (CVE-2026-91418)
  • java-11-openjdk: Enhance XML Processing (Oracle CPU 2026-10) (CVE-2026-83400)
  • java-11-openjdk: Enhance Kerberos validation (Oracle CPU 2026-10) (CVE-2026-91464)
  • java-11-openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10) (CVE-2026-91398)
  • java-11-openjdk: Enhance XPath Expressions (Oracle CPU 2026-10) (CVE-2026-87290)
  • java-11-openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10) (CVE-2026-83374)
  • java-11-openjdk: Enhance krb5 client (Oracle CPU 2026-10) (CVE-2026-91463)
  • java-11-openjdk: Enhance jmod handling (Oracle CPU 2026-10) (CVE-2026-91375)
  • java-11-openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10) (CVE-2026-87294)
  • java-11-openjdk: Enhance HTTP client caching (Oracle CPU 2026-10) (CVE-2026-91394)
  • java-11-openjdk: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-91403)
  • java-11-openjdk: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114820)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • OpenJDK Java Extended Life Cycle Support 11 for RHEL 9 x86_64
  • OpenJDK Java Extended Life Cycle Support 11 for RHEL 9 s390x
  • OpenJDK Java Extended Life Cycle Support 11 for RHEL 9 ppc64le
  • OpenJDK Java Extended Life Cycle Support 11 for RHEL 9 aarch64
  • OpenJDK Java Extended Life Cycle Support 11 for RHEL 8 x86_64
  • OpenJDK Java Extended Life Cycle Support 11 for RHEL 8 s390x
  • OpenJDK Java Extended Life Cycle Support 11 for RHEL 8 ppc64le
  • OpenJDK Java Extended Life Cycle Support 11 for RHEL 8 aarch64
  • OpenJDK Java Extended Life Cycle Support 11 for RHEL 7 x86_64
  • OpenJDK Java Extended Life Cycle Support 11 for RHEL 7 s390x

Fixes

  • BZ - 2556709 - CVE-2026-91487 openjdk: Enhance C2 comparisons (Oracle CPU 2026-10)
  • BZ - 2556795 - CVE-2026-91400 openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)
  • BZ - 2556824 - CVE-2026-91379 openjdk: Enhance JShell (Oracle CPU 2026-10)
  • BZ - 2556837 - CVE-2026-91461 openjdk: Enhance TLS Extensions (Oracle CPU 2026-10)
  • BZ - 2556859 - CVE-2026-91380 openjdk: Enhance Preferences (Oracle CPU 2026-10)
  • BZ - 2556922 - CVE-2026-91411 openjdk: Enhance JGSS (Oracle CPU 2026-10)
  • BZ - 2557007 - CVE-2026-91397 openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10)
  • BZ - 2557032 - CVE-2026-83381 openjdk: Enhance SASL Authentication (Oracle CPU 2026-10)
  • BZ - 2557041 - CVE-2026-91332 openjdk: Enhance HTTP Client (Oracle CPU 2026-10)
  • BZ - 2557047 - CVE-2026-91453 openjdk: Improve HTTP headers (Oracle CPU 2026-10)
  • BZ - 2557079 - CVE-2026-101516 openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10)
  • BZ - 2557097 - CVE-2026-91396 openjdk: Improve Pack200 handling (Oracle CPU 2026-10)
  • BZ - 2557110 - CVE-2026-83395 openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10)
  • BZ - 2557117 - CVE-2026-91451 openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10)
  • BZ - 2557122 - CVE-2026-83387 openjdk: Enhance WebRowSets (Oracle CPU 2026-10)
  • BZ - 2557195 - CVE-2026-91452 openjdk: Enhance HTTP server (Oracle CPU 2026-10)
  • BZ - 2557236 - CVE-2026-91462 openjdk: Enhance krb5 tokens (Oracle CPU 2026-10)
  • BZ - 2557261 - CVE-2026-87292 openjdk: Enhance Network Clients (Oracle CPU 2026-10)
  • BZ - 2557356 - CVE-2026-91373 openjdk: Enhance TLS handshakes (Oracle CPU 2026-10)
  • BZ - 2557385 - CVE-2026-91395 openjdk: Enhance Pack200 unpacking (Oracle CPU 2026-10)
  • BZ - 2557405 - CVE-2026-91410 openjdk: Enhance zipfs (Oracle CPU 2026-10)
  • BZ - 2557427 - CVE-2026-83376 openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10)
  • BZ - 2557443 - CVE-2026-91415 openjdk: Enhance font rendering (Oracle CPU 2026-10)
  • BZ - 2557506 - CVE-2026-83380 openjdk: Enhance LDAP logins (Oracle CPU 2026-10)
  • BZ - 2557558 - CVE-2026-87367 openjdk: Enhance Template Handling (Oracle CPU 2026-10)
  • BZ - 2557564 - CVE-2026-91374 openjdk: Enhance jstatd (Oracle CPU 2026-10)
  • BZ - 2557598 - CVE-2026-91335 openjdk: Enhance Image Handling (Oracle CPU 2026-10)
  • BZ - 2557662 - CVE-2026-91334 openjdk: Enhance JPEG loading (Oracle CPU 2026-10)
  • BZ - 2557665 - CVE-2026-91382 openjdk: Enhance Image Processing (Oracle CPU 2026-10)
  • BZ - 2557674 - CVE-2026-91418 openjdk: Enhance GIF loading (Oracle CPU 2026-10)
  • BZ - 2557690 - CVE-2026-83400 openjdk: Enhance XML Processing (Oracle CPU 2026-10)
  • BZ - 2557709 - CVE-2026-91464 openjdk: Enhance Kerberos validation (Oracle CPU 2026-10)
  • BZ - 2557711 - CVE-2026-91398 openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10)
  • BZ - 2557731 - CVE-2026-87290 openjdk: Enhance XPath Expressions (Oracle CPU 2026-10)
  • BZ - 2557765 - CVE-2026-83374 openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10)
  • BZ - 2557780 - CVE-2026-91463 openjdk: Enhance krb5 client (Oracle CPU 2026-10)
  • BZ - 2557857 - CVE-2026-91375 openjdk: Enhance jmod handling (Oracle CPU 2026-10)
  • BZ - 2557906 - CVE-2026-87294 openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10)
  • BZ - 2557956 - CVE-2026-91394 openjdk: Enhance HTTP client caching (Oracle CPU 2026-10)
  • BZ - 2558584 - CVE-2026-91403 OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns
  • BZ - 2560322 - CVE-2026-114820 OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.