Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
OpenJDK 21 lets remote attackers read data or crash
published 2 months ago
Summary
Several parts of the Java runtime used in OpenJDK 21 do not properly check who is allowed to use them. This mistake could let someone on the network view or change private information, or cause the program to stop working. Update to the latest OpenJDK release as soon as possible to fix the checks.
What to do
- Update canonical openjdk-21 to version 21.0.12+8-1~20.04.
- Update canonical openjdk-21 to version 21.0.12+8-1~22.04.
- Update canonical openjdk-21 to version 21.0.12+8-1~24.04.
- Update canonical openjdk-21 to version 21.0.12+8-1~26.04.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:20.04:LTS | canonical | openjdk-21 |
< 21.0.12+8-1~20.04 Fix: upgrade to 21.0.12+8-1~20.04
|
| Ubuntu:22.04:LTS | canonical | openjdk-21 |
< 21.0.12+8-1~22.04 Fix: upgrade to 21.0.12+8-1~22.04
|
| Ubuntu:24.04:LTS | canonical | openjdk-21 |
< 21.0.12+8-1~24.04 Fix: upgrade to 21.0.12+8-1~24.04
|
| Ubuntu:26.04:LTS | canonical | openjdk-21 |
< 21.0.12+8-1~26.04 Fix: upgrade to 21.0.12+8-1~26.04
|
Original advisory text
openjdk-21 vulnerabilities
It was discovered that the JSSE component of OpenJDK 21 did not correctly
authenticate users. A remote attacker could possibly use this issue to read
or modify sensitive data. (CVE-2026-46968)
It was discovered that the JSSE component of OpenJDK 21 did not correctly
authorize users. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2026-46917)
It was discovered that the ImageIO component of OpenJDK 21 did not
correctly authorize users. A remote attacker could possibly use this issue
to read or modify sensitive data. (CVE-2026-47010)
It was discovered that the 2D component of OpenJDK 21 did not correctly
authorize users. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2026-47021, CVE-2026-47059)
It was discovered that the Libraries component of OpenJDK 21 did not
correctly authorize users. A remote attacker could possibly use this issue
to cause a denial of service. (CVE-2026-47027)
It was discovered that the Security component of OpenJDK 21 did not
correctly authenticate users. A remote attacker could possibly use this
issue to read or modify sensitive data. (CVE-2026-60147)
It was discovered that the Libraries component of OpenJDK 21 did not
correctly authenticate users. A remote attacker could possibly use this
issue to read or modify sensitive data. (CVE-2026-47063)
It was discovered that the 2D (Little CMS) component of OpenJDK 21 did not
correctly handle certain integer arithmetic. An attacker could possibly use
this issue to cause a denial of service. (CVE-2026-41254)
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://openjdk.org/groups/vulnerability/advisories/2026-07-21
authenticate users. A remote attacker could possibly use this issue to read
or modify sensitive data. (CVE-2026-46968)
It was discovered that the JSSE component of OpenJDK 21 did not correctly
authorize users. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2026-46917)
It was discovered that the ImageIO component of OpenJDK 21 did not
correctly authorize users. A remote attacker could possibly use this issue
to read or modify sensitive data. (CVE-2026-47010)
It was discovered that the 2D component of OpenJDK 21 did not correctly
authorize users. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2026-47021, CVE-2026-47059)
It was discovered that the Libraries component of OpenJDK 21 did not
correctly authorize users. A remote attacker could possibly use this issue
to cause a denial of service. (CVE-2026-47027)
It was discovered that the Security component of OpenJDK 21 did not
correctly authenticate users. A remote attacker could possibly use this
issue to read or modify sensitive data. (CVE-2026-60147)
It was discovered that the Libraries component of OpenJDK 21 did not
correctly authenticate users. A remote attacker could possibly use this
issue to read or modify sensitive data. (CVE-2026-47063)
It was discovered that the 2D (Little CMS) component of OpenJDK 21 did not
correctly handle certain integer arithmetic. An attacker could possibly use
this issue to cause a denial of service. (CVE-2026-41254)
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://openjdk.org/groups/vulnerability/advisories/2026-07-21
References
- https://ubuntu.com/security/notices/USN-8677-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-41254 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-46917 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-46968 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-47010 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-47021 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-47027 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-47059 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-47063 Third Party Advisory
- https://ubuntu.com/security/CVE-2026-60147 Third Party Advisory
Timeline
Published25 Aug 2026
Updated26 Aug 2026
First seen26 Aug 2026
Sources
USN-8677-1 · OSV
Track software like this
Free during beta