https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T17:17:15.428993+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:9693 ALSA-2026:9693 — Important: java-25-openjdk security update 2026-10-02T17:17:15.682370+00:00

Affected: AlmaLinux:10: java-25-openjdk, AlmaLinux:10: java-25-openjdk-crypto-adapter, AlmaLinux:10: java-25-openjdk-crypto-adapter-fastdebug, AlmaLinux:10: java-25-openjdk-crypto-adapter-slowdebug, AlmaLinux:10: java-25-openjdk-demo, AlmaLinux:10: java-25-openjdk-demo-fastdebug, AlmaLinux:10: java-25-openjdk-demo-slowdebug, AlmaLinux:10: java-25-openjdk-devel, AlmaLinux:10: java-25-openjdk-devel-fastdebug, AlmaLinux:10: java-25-openjdk-devel-slowdebug and 42 more

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit.

Security Fix(es):

* JDK: Enhance crypto algorithm support (CVE-2026-22007) * JDK: Improved Arena allocations (CVE-2026-22008) * JDK: Improve Kerberos credentialing (CVE-2026-22013) * JDK: Enhance Path Factories Redux (CVE-2026-22016) * JDK: Enhance Zip file reading (CVE-2026-22018) * JDK: Enhance certificate chain validation (CVE-2026-22021) * JDK: Updating FreeType 2.14.1 (CVE-2026-23865) * JDK: Enhance TLS connection handling (CVE-2026-34282) * JDK: Enhance key generation (CVE-2026-34268)

This release also updates a number of third-party libraries included in the JDK. The libraries themselves are affected by the following CVEs, but this is not a statement that the JDK itself is affected:

* giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740) * libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) * libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

Bug Fix(es):

* When copying files, OpenJDK 25 prefers to use the copy_file_range native function for performance reasons, only falling back to sendfile when this fails. However, in previous OpenJDK 25 releases, a response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile. This is rectified in thi…

 https://cve.radiocsirt.org/vuln/bdu:2026-06609 bdu:2026-06609 2026-10-02T17:17:15.682511+00:00 bdu:2026-06609 https://cve.radiocsirt.org/vuln/bell-cve-2026-22008 BELL-CVE-2026-22008 2026-10-02T17:17:15.682530+00:00

Affected: Alpaquita:23: openjdk-nik-25-25, Alpaquita:23: openjdk25, Alpaquita:23: openjdk25-container-jre, Alpaquita:23: openjdk25-lite, Alpaquita:23: openjdk26, Alpaquita:23: openjdk26-container-jre, Alpaquita:23: openjdk26-lite, Alpaquita:25: openjdk-nik-25-25, Alpaquita:25: openjdk25, Alpaquita:25: openjdk25-container-jre and 26 more

 https://cve.radiocsirt.org/vuln/bit-java-2026-22008 BIT-java-2026-22008 2026-10-02T17:17:15.682589+00:00

Affected: Bitnami: java

Vulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0468 certfr-2026-avi-0468 — De multiples vulnérabilités ont été découvertes dans Oracle Java SE. Elles permettent à un attaquant de provoquer un dé… 2026-10-02T17:17:15.682615+00:00 certfr-2026-avi-0468 https://cve.radiocsirt.org/vuln/euvd-2026-292466 EUVD-2026-292466 2026-10-02T17:17:15.682630+00:00 EUVD-2026-292466 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22008 fkie_cve-2026-22008 2026-10-02T17:17:15.682641+00:00

Vulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

 https://cve.radiocsirt.org/vuln/ghsa-ffgj-wmrh-m8fr GHSA-ffgj-wmrh-m8fr 2026-10-02T17:17:15.682666+00:00

Vulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

 https://cve.radiocsirt.org/vuln/oesa-2026-3818 OESA-2026-3818 — openjdk-11 security update 2026-10-02T17:17:15.682685+00:00

Affected: openEuler:20.03-LTS-SP4: openjdk-11, openEuler:22.03-LTS-SP4: openjdk-11, openEuler:24.03-LTS-SP1: openjdk-11, openEuler:24.03-LTS-SP3: openjdk-11, openEuler:24.03-LTS-SP4: openjdk-11

The OpenJDK runtime environment. Security Fix(es):

Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the program leaks memory in various locations, eventually leading to high memory usage and causing the program to become unresponsive(CVE-2025-28162)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.(CVE-2025-53057)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulne…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10639-1 openSUSE-SU-2026:10639-1 — java-25-openjdk-25.0.3.0-1.1 on GA media 2026-10-02T17:17:15.682876+00:00

java-25-openjdk-25.0.3.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:7286 RHSA-2026:7286 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-02T17:17:15.682899+00:00

openjdk: Improved Arena allocations (Oracle CPU 2026-04)

 https://cve.radiocsirt.org/vuln/suse-su-2026:21543-1 SUSE-SU-2026:21543-1 — Security update for java-25-openjdk 2026-10-02T17:17:15.682914+00:00

Security update for java-25-openjdk

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-22008 UBUNTU-CVE-2026-22008 2026-10-02T17:17:15.682934+00:00

Affected: Ubuntu:16.04:LTS: openjdk-9, Ubuntu:20.04:LTS: openjdk-13, Ubuntu:20.04:LTS: openjdk-16, Ubuntu:22.04:LTS: openjdk-18, Ubuntu:22.04:LTS: openjdk-25, Ubuntu:24.04:LTS: openjdk-25, Ubuntu:25.10: openjdk-25, Ubuntu:25.10: openjdk-25-crac, Ubuntu:25.10: openjdk-26, Ubuntu:26.04:LTS: openjdk-25 and 2 more

Vulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1201 WID-SEC-W-2026-1201 — Oracle Java SE: Mehrere Schwachstellen 2026-10-02T17:17:15.682974+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Java SE ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.