CVE-2026-91403
Description
The certificate authority (CA) store used in OpenJDK and Oracle Java included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL Java client applications and cause such applications to connect to malicious sites.
Security Bulletin
Statement
The OpenJDK RPM packages in Red Hat Enterprise Linux do not include their own CA certificate bundle and instead rely on ca-certificates packages for their default CA certificate store. Therefore, those OpenJDK versions require an updated ca-certificates RPM package to be installed to address this issue (refer to CVE-2026-114406 for more details about available ca-certificates package updates).
The OpenJDK packages in the Red Hat build of OpenJDK product for both Linux and Windows include their own CA certificate store file and therefore need to be updated separately from the ca-certificates updates.
The certificate bundle used in OpenJDK upstream included root certificates that signed eMudhra intermediate certificates with weak keys. OpenJDK upstream first attempted to address this issue by only blocking problematic intermediate certificates without changing the list of trusted root CAs. CVE-2026-91403 was assigned to that change. However, the fix proved insufficient and easy to bypass; therefore, OpenJDK upstream later removed the relevant root CA certificates, and a new CVE-2026-114820 was assigned to that change.
Since the problem for OpenJDK packages in Red Hat Enterprise Linux was addressed via ca-certificates updates, and the fix applied under this CVE is incorrect, Red Hat does not plan to issue updates for Red Hat Enterprise Linux claiming to address this CVE.
Mitigation
Users of OpenJDK RPM packages in Red Hat Enterprise Linux can resolve this issue by installing updated ca-certificates packages fixing CVE-2026-114406.
Also refer to the detailed information in the RHSB-2026-012 security bulletin for other mitigation steps if updating ca-certificates packages is not possible.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | N/A | 9.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Integrity,Authentication
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
