Red Hat Security Advisory

RHSA-2026:0927

java-17-openjdk security update

Released 2026-01-22 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder EUS (v.9.4) java-17-openjdk-demo-fastdebug-1:17.0.18.0.8-1.el9, java-17-openjdk-demo-slowdebug-1:17.0.18.0.8-1.el9, java-17-openjdk-devel-fastdebug-1:17.0.18.0.8-1.el9 +11
Red Hat CodeReady Linux Builder EUS (v.9.6) java-17-openjdk-demo-fastdebug-1:17.0.18.0.8-1.el9, java-17-openjdk-demo-slowdebug-1:17.0.18.0.8-1.el9, java-17-openjdk-devel-fastdebug-1:17.0.18.0.8-1.el9 +11
Red Hat Enterprise Linux AppStream (v. 8) java-17-openjdk-1:17.0.18.0.8-1.el8, java-17-openjdk-demo-1:17.0.18.0.8-1.el8, java-17-openjdk-devel-1:17.0.18.0.8-1.el8 +6
Red Hat Enterprise Linux AppStream (v. 9) java-17-openjdk-1:17.0.18.0.8-1.el9, java-17-openjdk-demo-1:17.0.18.0.8-1.el9, java-17-openjdk-devel-1:17.0.18.0.8-1.el9 +6
Red Hat Enterprise Linux AppStream AUS (v.8.4) java-17-openjdk-1:17.0.18.0.8-1.el8, java-17-openjdk-demo-1:17.0.18.0.8-1.el8, java-17-openjdk-devel-1:17.0.18.0.8-1.el8 +6
Red Hat Enterprise Linux AppStream AUS (v.8.6) java-17-openjdk-1:17.0.18.0.8-1.el8, java-17-openjdk-demo-1:17.0.18.0.8-1.el8, java-17-openjdk-devel-1:17.0.18.0.8-1.el8 +6
Red Hat Enterprise Linux AppStream E4S (v.8.6) java-17-openjdk-1:17.0.18.0.8-1.el8, java-17-openjdk-demo-1:17.0.18.0.8-1.el8, java-17-openjdk-devel-1:17.0.18.0.8-1.el8 +6
Red Hat Enterprise Linux AppStream E4S (v.8.8) java-17-openjdk-1:17.0.18.0.8-1.el8, java-17-openjdk-demo-1:17.0.18.0.8-1.el8, java-17-openjdk-devel-1:17.0.18.0.8-1.el8 +6
Red Hat Enterprise Linux AppStream E4S (v.9.0) java-17-openjdk-1:17.0.18.0.8-1.el9, java-17-openjdk-demo-1:17.0.18.0.8-1.el9, java-17-openjdk-devel-1:17.0.18.0.8-1.el9 +6
Red Hat Enterprise Linux AppStream E4S (v.9.2) java-17-openjdk-1:17.0.18.0.8-1.el9, java-17-openjdk-demo-1:17.0.18.0.8-1.el9, java-17-openjdk-devel-1:17.0.18.0.8-1.el9 +6
Red Hat Enterprise Linux AppStream EUS (v.9.4) java-17-openjdk-1:17.0.18.0.8-1.el9, java-17-openjdk-demo-1:17.0.18.0.8-1.el9, java-17-openjdk-devel-1:17.0.18.0.8-1.el9 +6
Red Hat Enterprise Linux AppStream EUS (v.9.6) java-17-openjdk-1:17.0.18.0.8-1.el9, java-17-openjdk-demo-1:17.0.18.0.8-1.el9, java-17-openjdk-devel-1:17.0.18.0.8-1.el9 +6
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) java-17-openjdk-1:17.0.18.0.8-1.el8, java-17-openjdk-demo-1:17.0.18.0.8-1.el8, java-17-openjdk-demo-fastdebug-1:17.0.18.0.8-1.el8 +20
Red Hat Enterprise Linux AppStream TUS (v.8.6) java-17-openjdk-1:17.0.18.0.8-1.el8, java-17-openjdk-demo-1:17.0.18.0.8-1.el8, java-17-openjdk-devel-1:17.0.18.0.8-1.el8 +6
Red Hat Enterprise Linux AppStream TUS (v.8.8) java-17-openjdk-1:17.0.18.0.8-1.el8, java-17-openjdk-demo-1:17.0.18.0.8-1.el8, java-17-openjdk-devel-1:17.0.18.0.8-1.el8 +6
Red Hat Enterprise Linux CRB (v. 8) java-17-openjdk-demo-fastdebug-1:17.0.18.0.8-1.el8, java-17-openjdk-demo-slowdebug-1:17.0.18.0.8-1.el8, java-17-openjdk-devel-fastdebug-1:17.0.18.0.8-1.el8 +11
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-17-openjdk-demo-fastdebug-1:17.0.18.0.8-1.el9, java-17-openjdk-demo-slowdebug-1:17.0.18.0.8-1.el9, java-17-openjdk-devel-fastdebug-1:17.0.18.0.8-1.el9 +11

Fixes 5 records

TI-2025-40204 CVE-2025-65018

LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`

HIGH 66

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.00278 Published 2025-11-24 Partial fix · 1.6.51 CWE-122

TI-2025-40066 CVE-2025-64720

LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication

MEDIUM 64

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00447 Published 2025-11-24 Partial fix · 1.6.51 CWE-125

TI-2026-17645 CVE-2026-21945 · GHSA-r2mr-x4h2-9chr

Uncontrolled resource consumption in Oracle Java SE

MEDIUM 41

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00992 Published 2026-01-20 Partial fix CWE-400

TI-2026-17633 CVE-2026-21933 · GHSA-5rm3-299f-6m9v

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise…

LOW 27

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00299 Published 2026-01-20 Partial fix

TI-2026-17625 CVE-2026-21925 · GHSA-jhg6-g5fp-536p

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise…

LOW 22

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI).

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00254 Published 2026-01-20 Partial fix