Red Hat Security Advisory

RHSA-2026:90500

java-17-openjdk security update for RHEL 9

Released 2026-10-31 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder EUS (v.9.6) java-17-openjdk-demo-fastdebug-1:17.0.21.0.9-2.1.el9, java-17-openjdk-demo-slowdebug-1:17.0.21.0.9-2.1.el9, java-17-openjdk-devel-fastdebug-1:17.0.21.0.9-2.1.el9 +11
Red Hat Enterprise Linux AppStream (v. 9) java-17-openjdk-1:17.0.21.0.9-2.2.el9, java-17-openjdk-demo-1:17.0.21.0.9-2.2.el9, java-17-openjdk-devel-1:17.0.21.0.9-2.2.el9 +6
Red Hat Enterprise Linux AppStream E4S (v.9.2) java-17-openjdk-1:17.0.21.0.9-2.1.el9, java-17-openjdk-demo-1:17.0.21.0.9-2.1.el9, java-17-openjdk-devel-1:17.0.21.0.9-2.1.el9 +6
Red Hat Enterprise Linux AppStream E4S (v.9.4) java-17-openjdk-1:17.0.21.0.9-2.1.el9, java-17-openjdk-demo-1:17.0.21.0.9-2.1.el9, java-17-openjdk-devel-1:17.0.21.0.9-2.1.el9 +6
Red Hat Enterprise Linux AppStream EUS (v.9.6) java-17-openjdk-1:17.0.21.0.9-2.1.el9, java-17-openjdk-demo-1:17.0.21.0.9-2.1.el9, java-17-openjdk-devel-1:17.0.21.0.9-2.1.el9 +6
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-17-openjdk-demo-fastdebug-1:17.0.21.0.9-2.2.el9, java-17-openjdk-demo-slowdebug-1:17.0.21.0.9-2.2.el9, java-17-openjdk-devel-fastdebug-1:17.0.21.0.9-2.2.el9 +11

Fixes 36 records

TI-2026-77105 CVE-2026-83395 · GHSA-gw5f-5p5f-mw2c

Improper access control in Oracle Java SE networking component

LOW 35

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00327 Published 2026-10-20 Partial fix CWE-284

TI-2026-77828 CVE-2026-101516 · GHSA-4p83-qqhw-ff66

Improper access control in Oracle Java SE

LOW 34

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00267 Published 2026-10-20 Partial fix CWE-284

TI-2026-77135 CVE-2026-87294 · GHSA-f77q-p3hr-hvw8

Improper access control in Oracle Java SE and GraalVM products

LOW 34

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00262 Published 2026-10-20 Partial fix CWE-284

TI-2026-77508 CVE-2026-91453 · GHSA-wh5x-8c26-q7r3

Improper access control in Oracle Java SE Lightweight HTTP Server

LOW 30

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0029 Published 2026-10-20 Partial fix CWE-284

TI-2026-77507 CVE-2026-91452 · GHSA-vgqv-368p-h4w6

Improper access control in Oracle Java SE Networking component

LOW 30

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0029 Published 2026-10-20 Partial fix CWE-284

TI-2026-77506 CVE-2026-91451 · GHSA-vqqv-7v72-gw94

Improper access control in Oracle Java SE Networking component

LOW 30

Vulnerability in Oracle Java SE (component: Networking).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0029 Published 2026-10-20 Partial fix CWE-284

TI-2026-77474 CVE-2026-91418 · GHSA-xjm9-7q5c-fwv4

Uncontrolled resource consumption in Oracle Java SE ImageIO

LOW 30

Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00403 Published 2026-10-20 Partial fix CWE-400

TI-2026-77472 CVE-2026-91415 · GHSA-vmv5-g2r5-cqmj

Improper input validation in Oracle Java SE

LOW 30

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).

CVSS 3.1HIGH 7.0 Network No auth No interaction EPSS 0.00239 Published 2026-10-20 Partial fix CWE-20

TI-2026-77467 CVE-2026-91410 · GHSA-mghm-6x2r-44cm

Uncontrolled resource consumption in Oracle Java SE Libraries

LOW 30

Vulnerability in Oracle Java SE (component: Libraries).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00306 Published 2026-10-20 Partial fix CWE-400

TI-2026-77457 CVE-2026-91398 · GHSA-g7qg-48g2-c549

Improper access control in Oracle Java SE networking component

LOW 30

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.00231 Published 2026-10-20 Partial fix CWE-284

TI-2026-77432 CVE-2026-91373 · GHSA-v4m5-q3qj-q97q

Uncontrolled resource consumption in Oracle Java SE JSSE

LOW 30

Vulnerability in Oracle Java SE (component: JSSE).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00441 Published 2026-10-20 Partial fix CWE-400

TI-2026-77391 CVE-2026-91332 · GHSA-wvph-jvc9-24rg

Improper access control in Oracle Java SE Networking component

LOW 30

Vulnerability in Oracle Java SE (component: Networking).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0029 Published 2026-10-20 Partial fix CWE-284

TI-2026-77110 CVE-2026-83400 · GHSA-qcmg-2jg9-9qj3

Uncontrolled resource consumption in Oracle Java SE and GraalVM JAXP

LOW 30

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00396 Published 2026-10-20 Partial fix CWE-400

TI-2026-77090 CVE-2026-83380 · GHSA-rcw5-53h9-w9g6

Information disclosure in Oracle Java SE

LOW 30

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAAS).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00325 Published 2026-10-20 Partial fix CWE-200

TI-2026-77441 CVE-2026-91382 · GHSA-wp5h-3q7r-3q8q

Improper access control in Oracle Java SE 2D component

LOW 29

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00377 Published 2026-10-20 Partial fix CWE-284

TI-2026-77453 CVE-2026-91394 · GHSA-fcqj-9fxv-7fq3

Sensitive information exposure in Oracle Java SE Networking

LOW 27

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking).

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00419 Published 2026-10-20 Partial fix CWE-200

TI-2026-77515 CVE-2026-91462 · GHSA-g364-xwwc-5hvh

Improper access control in Oracle Java SE JGSS component

LOW 26

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00274 Published 2026-10-20 Partial fix CWE-284

TI-2026-77131 CVE-2026-87290 · GHSA-p9mx-r8ww-77qq

Sensitive information exposure in Oracle Java SE JAXP component

LOW 26

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00327 Published 2026-10-20 Partial fix CWE-200

TI-2026-77097 CVE-2026-83387 · GHSA-jvp7-wjj3-pg66

Sensitive information exposure in Oracle Java SE JDBC component

LOW 26

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JDBC).

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00327 Published 2026-10-20 Partial fix CWE-200

TI-2026-77084 CVE-2026-83374 · GHSA-p25v-754r-q26h

Oracle Java SE and GraalVM information exposure in Security component

LOW 26

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00289 Published 2026-10-20 Partial fix CWE-200

TI-2026-77517 CVE-2026-91464 · GHSA-gj42-xjcm-wrr9

Use after free in Oracle Java SE JGSS component

LOW 24

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.00289 Published 2026-10-20 Partial fix CWE-416

TI-2026-77516 CVE-2026-91463 · GHSA-pq5q-77c8-hwjv

Use-after-free in Oracle Java SE JGSS component

LOW 23

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.00227 Published 2026-10-20 Partial fix CWE-416

TI-2026-77537 CVE-2026-91487 · GHSA-5f2x-x4h6-xw49

Improper access control in Oracle Java SE Compiler component

LOW 21

Vulnerability in Oracle Java SE (component: Compiler).

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00168 Published 2026-10-20 Partial fix CWE-284

TI-2026-77433 CVE-2026-91374 · GHSA-h6m7-6w4j-rx23

Improper access control in Oracle Java SE and GraalVM products

LOW 21

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serviceability).

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00168 Published 2026-10-20 Partial fix CWE-284

TI-2026-77091 CVE-2026-83381 · GHSA-wh8h-835p-j93v

Sensitive information exposure in Oracle Java SE Security component

LOW 21

Vulnerability in Oracle Java SE (component: Security).

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00226 Published 2026-10-20 Partial fix CWE-200

TI-2026-77438 CVE-2026-91379 · GHSA-53gh-9p66-w4f4

Use after free in Oracle Java SE and GraalVM JDK tools

LOW 20

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JDK tools).

CVSS 3.1MEDIUM 4.7 Local No auth User interaction EPSS 0.00122 Published 2026-10-20 Partial fix CWE-416

TI-2026-77434 CVE-2026-91375 · GHSA-r2p6-wxc8-pmpv

Incorrect authorization in Oracle Java SE Libraries component

LOW 20

Vulnerability in Oracle Java SE (component: Libraries).

CVSS 3.1MEDIUM 4.7 Local No auth User interaction EPSS 0.00092 Published 2026-10-20 Partial fix CWE-863

TI-2026-77514 CVE-2026-91461 · GHSA-hrmf-22mm-2484

Oracle Java SE and GraalVM JSSE improper certificate validation

LOW 17

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00187 Published 2026-10-20 Partial fix CWE-295

TI-2026-77439 CVE-2026-91380 · GHSA-qpg8-xfmg-2j85

Oracle Java SE and GraalVM Improper Access Control in Utility Component

LOW 17

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility).

CVSS 3.1MEDIUM 4.0 Local No auth No interaction EPSS 0.00097 Published 2026-10-20 Partial fix CWE-284

TI-2026-77393 CVE-2026-91334 · GHSA-x8mv-p396-jh2r

Oracle Java SE ImageIO flaw allows unauthorized read access

LOW 17

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00208 Published 2026-10-20 Partial fix CWE-200

TI-2026-77207 CVE-2026-87367 · GHSA-m2mw-3v6r-66h4

Unauthorized data changes in Oracle Java SE JAXP component

LOW 17

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00252 Published 2026-10-20 Partial fix CWE-200

TI-2026-77133 CVE-2026-87292 · GHSA-wfmw-xhqr-83hm

Improper authentication in Oracle Java SE Networking component

LOW 17

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00239 Published 2026-10-20 Partial fix CWE-287

TI-2026-77086 CVE-2026-83376 · GHSA-cwrm-2mfc-rwqh

Oracle Java SE JSSE component flaw lets attackers alter data

LOW 17

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00252 Published 2026-10-20 Partial fix CWE-200

TI-2026-77456 CVE-2026-91397 · GHSA-xqpm-j9mr-99m8

Improper access control in Oracle Java SE and GraalVM products

LOW 16

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serviceability).

CVSS 3.1LOW 3.6 Local No auth User interaction EPSS 0.00095 Published 2026-10-20 Partial fix CWE-284

TI-2026-77459 CVE-2026-91400 · GHSA-52rv-2r96-ffhw

Uncontrolled resource consumption in Oracle Java SE Sound component

LOW 15

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound).

CVSS 3.1LOW 3.1 Network No auth User interaction EPSS 0.00257 Published 2026-10-20 Partial fix CWE-400

TI-2026-77394 CVE-2026-91335 · GHSA-jp97-m28p-vxx8

Information disclosure in Oracle Java SE AWT component

LOW 13

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT).

CVSS 3.1LOW 2.6 Network Low privileges User interaction EPSS 0.0021 Published 2026-10-20 Partial fix CWE-250