Red Hat Security AdvisoryRHSA-2026:9254
Java 11 OpenJDK ELS Security Update
Released 2026-04-22 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenJDK 11 ELS for RHEL 7 java-11-openjdk-1:11.0.31.0.11-1.el7_9, java-11-openjdk-debug-1:11.0.31.0.11-1.el7_9, java-11-openjdk-demo-1:11.0.31.0.11-1.el7_9 +15
- Red Hat OpenJDK 11 ELS for RHEL 8 java-11-openjdk-1:11.0.31.0.11-1.el8, java-11-openjdk-demo-1:11.0.31.0.11-1.el8, java-11-openjdk-demo-fastdebug-1:11.0.31.0.11-1.el8 +20
- Red Hat OpenJDK 11 ELS for RHEL 9 java-11-openjdk-1:11.0.31.0.11-1.el9, java-11-openjdk-demo-1:11.0.31.0.11-1.el9, java-11-openjdk-demo-fastdebug-1:11.0.31.0.11-1.el9 +20
Fixes 12 records
Priority MEDIUM 40
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00635 · Published 2026-04-21 · Partial fix CWE-400
Priority MEDIUM 40
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00702 · Published 2026-04-21 · Partial fix CWE-200
Priority LOW 37
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.
CVSS 3.1HIGH 7.5· Network · No auth · User interaction · EPSS 0.01071 · Published 2026-03-26 · Partial fix · 1.6.56 CWE-416
Priority LOW 35
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.
CVSS 3.1HIGH 7.6· Network · No auth · User interaction · EPSS 0.00751 · Published 2026-03-26 · Partial fix · 1.6.56 CWE-125
Priority LOW 33
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00134 · Published 2026-01-12 · Partial fix · 1.6.54 CWE-125
Priority LOW 31
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.
CVSS 3.1HIGH 7.1· Local · No auth · User interaction · EPSS 0.00222 · Published 2026-01-12 · Partial fix · 1.6.54 CWE-125
Priority LOW 30
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00305 · Published 2026-04-21 · Partial fix CWE-400
Priority LOW 24
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).
CVSS 3.1MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00258 · Published 2026-04-21 · Partial fix CWE-693
Priority LOW 23
An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType vari…
CVSS 3.1MEDIUM 5.3· Local · No auth · User interaction · EPSS 0.00166 · Published 2026-03-02 · Partial fix CWE-125
Priority LOW 17
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00269 · Published 2026-04-21 · Partial fix CWE-770
Priority LOW 13
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).
CVSS 3.1LOW 2.9· Local · No auth · No interaction · EPSS 0.00122 · Published 2026-04-21 · Partial fix CWE-200
Priority LOW 13
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).
CVSS 3.1LOW 2.9· Local · No auth · No interaction · EPSS 0.00124 · Published 2026-04-21 · Partial fix CWE-200
THREATIST.IORead the docs