Red Hat Security Advisory

RHSA-2026:42887

java-17-openjdk security update

Released 2026-07-23 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder EUS (v.9.6) java-17-openjdk-demo-fastdebug-1:17.0.20.0.8-1.1.el9, java-17-openjdk-demo-slowdebug-1:17.0.20.0.8-1.1.el9, java-17-openjdk-devel-fastdebug-1:17.0.20.0.8-1.1.el9 +11
Red Hat Enterprise Linux AppStream (v. 8) java-17-openjdk-1:17.0.20.0.8-1.1.el8, java-17-openjdk-demo-1:17.0.20.0.8-1.1.el8, java-17-openjdk-devel-1:17.0.20.0.8-1.1.el8 +6
Red Hat Enterprise Linux AppStream (v. 9) java-17-openjdk-1:17.0.20.0.8-1.2.el9, java-17-openjdk-demo-1:17.0.20.0.8-1.2.el9, java-17-openjdk-devel-1:17.0.20.0.8-1.2.el9 +6
Red Hat Enterprise Linux AppStream AUS (v.8.4) java-17-openjdk-1:17.0.20.0.8-1.1.el8, java-17-openjdk-demo-1:17.0.20.0.8-1.1.el8, java-17-openjdk-devel-1:17.0.20.0.8-1.1.el8 +6
Red Hat Enterprise Linux AppStream AUS (v.8.6) java-17-openjdk-1:17.0.20.0.8-1.1.el8, java-17-openjdk-demo-1:17.0.20.0.8-1.1.el8, java-17-openjdk-devel-1:17.0.20.0.8-1.1.el8 +6
Red Hat Enterprise Linux AppStream E4S (v.8.8) java-17-openjdk-1:17.0.20.0.8-1.1.el8, java-17-openjdk-demo-1:17.0.20.0.8-1.1.el8, java-17-openjdk-devel-1:17.0.20.0.8-1.1.el8 +6
Red Hat Enterprise Linux AppStream E4S (v.9.2) java-17-openjdk-1:17.0.20.0.8-1.1.el9, java-17-openjdk-demo-1:17.0.20.0.8-1.1.el9, java-17-openjdk-devel-1:17.0.20.0.8-1.1.el9 +6
Red Hat Enterprise Linux AppStream E4S (v.9.4) java-17-openjdk-1:17.0.20.0.8-1.1.el9, java-17-openjdk-demo-1:17.0.20.0.8-1.1.el9, java-17-openjdk-devel-1:17.0.20.0.8-1.1.el9 +6
Red Hat Enterprise Linux AppStream EUS (v.9.6) java-17-openjdk-1:17.0.20.0.8-1.1.el9, java-17-openjdk-demo-1:17.0.20.0.8-1.1.el9, java-17-openjdk-devel-1:17.0.20.0.8-1.1.el9 +6
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) java-17-openjdk-1:17.0.20.0.8-1.1.el8, java-17-openjdk-demo-1:17.0.20.0.8-1.1.el8, java-17-openjdk-demo-fastdebug-1:17.0.20.0.8-1.1.el8 +20
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) java-17-openjdk-1:17.0.20.0.8-1.1.el8, java-17-openjdk-demo-1:17.0.20.0.8-1.1.el8, java-17-openjdk-devel-1:17.0.20.0.8-1.1.el8 +6
Red Hat Enterprise Linux AppStream TUS (v.8.8) java-17-openjdk-1:17.0.20.0.8-1.1.el8, java-17-openjdk-demo-1:17.0.20.0.8-1.1.el8, java-17-openjdk-devel-1:17.0.20.0.8-1.1.el8 +6
Red Hat Enterprise Linux CRB (v. 8) java-17-openjdk-demo-fastdebug-1:17.0.20.0.8-1.1.el8, java-17-openjdk-demo-slowdebug-1:17.0.20.0.8-1.1.el8, java-17-openjdk-devel-fastdebug-1:17.0.20.0.8-1.1.el8 +11
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-17-openjdk-demo-fastdebug-1:17.0.20.0.8-1.2.el9, java-17-openjdk-demo-slowdebug-1:17.0.20.0.8-1.2.el9, java-17-openjdk-devel-fastdebug-1:17.0.20.0.8-1.2.el9 +11

Fixes 9 records

TI-2026-34665 CVE-2026-47063 · GHSA-vw39-pj36-hc59

Improper access control in Oracle Java SE

LOW 38

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00256 Published 2026-07-21 Partial fix CWE-284

TI-2026-42850 CVE-2026-60147 · GHSA-4pv6-97j8-3pwq

Improper access control in Oracle Java SE

LOW 35

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00287 Published 2026-07-21 Partial fix CWE-284

TI-2026-29862 CVE-2026-41254 · GHSA-hc77-37fq-x324

Integer overflow in littlecms little cms color engine

LOW 33

Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00364 Published 2026-04-18 Partial fix CWE-696

TI-2026-34631 CVE-2026-47027 · GHSA-cqfh-fjhw-mr88

Improper access control in Oracle Java SE

LOW 30

Vulnerability in Oracle Java SE (component: Libraries).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00289 Published 2026-07-21 Partial fix CWE-284

TI-2026-34626 CVE-2026-47021 · GHSA-qw6j-rcfr-8vrx

Uncontrolled resource consumption in Oracle Java SE

LOW 30

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00305 Published 2026-07-21 Partial fix CWE-400

TI-2026-34523 CVE-2026-46917 · GHSA-x5x7-pvpw-w5hv

Improper access control in Oracle Java SE

LOW 30

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00289 Published 2026-07-21 Partial fix CWE-284

TI-2026-34574 CVE-2026-46968 · GHSA-hhf8-3x8g-6pff

Improper access control in Oracle Java SE

LOW 26

Vulnerability in Oracle Java SE (component: JSSE).

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00291 Published 2026-07-21 Partial fix CWE-284

TI-2026-34661 CVE-2026-47059 · GHSA-c4gh-498r-f8f5

Improper access control in Oracle Java SE

LOW 17

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00306 Published 2026-07-21 Partial fix CWE-284

TI-2026-34616 CVE-2026-47010 · GHSA-fhjm-g79r-vv57

Improper access control in Oracle Java SE

LOW 17

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00254 Published 2026-07-21 Partial fix CWE-284