Red Hat Security Advisory

RHSA-2026:94069

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-11-02 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Hardened Images java-21-openjdk-portable-1:21.0.13.0.9-1.0.1.hum1@aarch64, java-21-openjdk-portable-1:21.0.13.0.9-1.0.1.hum1@s390x, java-21-openjdk-portable-1:21.0.13.0.9-1.0.1.hum1@src +31

Fixes 40 records

TI-2026-80094 CVE-2026-114820 · GHSA-255q-pwv4-fjj7

Risky cryptographic algorithm in Oracle Java SE JSSE component

MEDIUM 47

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00253 Published 2026-10-24 Partial fix CWE-327

TI-2026-79007 CVE-2026-91403 · GHSA-9h75-rf66-wh3r

Risky cryptographic algorithm use in Oracle Java SE JSSE component

MEDIUM 47

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00375 Published 2026-10-21 Partial fix CWE-327

TI-2026-77105 CVE-2026-83395 · GHSA-gw5f-5p5f-mw2c

Improper access control in Oracle Java SE networking component

LOW 35

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00327 Published 2026-10-20 Partial fix CWE-284

TI-2026-77828 CVE-2026-101516 · GHSA-4p83-qqhw-ff66

Improper access control in Oracle Java SE

LOW 34

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00267 Published 2026-10-20 Partial fix CWE-284

TI-2026-77135 CVE-2026-87294 · GHSA-f77q-p3hr-hvw8

Improper access control in Oracle Java SE and GraalVM products

LOW 34

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00262 Published 2026-10-20 Partial fix CWE-284

TI-2026-77508 CVE-2026-91453 · GHSA-wh5x-8c26-q7r3

Improper access control in Oracle Java SE Lightweight HTTP Server

LOW 30

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0029 Published 2026-10-20 Partial fix CWE-284

TI-2026-77507 CVE-2026-91452 · GHSA-vgqv-368p-h4w6

Improper access control in Oracle Java SE Networking component

LOW 30

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0029 Published 2026-10-20 Partial fix CWE-284

TI-2026-77506 CVE-2026-91451 · GHSA-vqqv-7v72-gw94

Improper access control in Oracle Java SE Networking component

LOW 30

Vulnerability in Oracle Java SE (component: Networking).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0029 Published 2026-10-20 Partial fix CWE-284

TI-2026-77474 CVE-2026-91418 · GHSA-xjm9-7q5c-fwv4

Uncontrolled resource consumption in Oracle Java SE ImageIO

LOW 30

Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00403 Published 2026-10-20 Partial fix CWE-400

TI-2026-77472 CVE-2026-91415 · GHSA-vmv5-g2r5-cqmj

Improper input validation in Oracle Java SE

LOW 30

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).

CVSS 3.1HIGH 7.0 Network No auth No interaction EPSS 0.00239 Published 2026-10-20 Partial fix CWE-20

TI-2026-77467 CVE-2026-91410 · GHSA-mghm-6x2r-44cm

Uncontrolled resource consumption in Oracle Java SE Libraries

LOW 30

Vulnerability in Oracle Java SE (component: Libraries).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00306 Published 2026-10-20 Partial fix CWE-400

TI-2026-77457 CVE-2026-91398 · GHSA-g7qg-48g2-c549

Improper access control in Oracle Java SE networking component

LOW 30

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.00231 Published 2026-10-20 Partial fix CWE-284

TI-2026-77432 CVE-2026-91373 · GHSA-v4m5-q3qj-q97q

Uncontrolled resource consumption in Oracle Java SE JSSE

LOW 30

Vulnerability in Oracle Java SE (component: JSSE).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00441 Published 2026-10-20 Partial fix CWE-400

TI-2026-77391 CVE-2026-91332 · GHSA-wvph-jvc9-24rg

Improper access control in Oracle Java SE Networking component

LOW 30

Vulnerability in Oracle Java SE (component: Networking).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0029 Published 2026-10-20 Partial fix CWE-284

TI-2026-77132 CVE-2026-87291 · GHSA-r3pr-m76q-f8wv

Oracle Java SE Networking flaw lets unauthenticated attacker read some data

LOW 30

Vulnerability in Oracle Java SE (component: Networking).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00308 Published 2026-10-20 Partial fix CWE-287

TI-2026-77110 CVE-2026-83400 · GHSA-qcmg-2jg9-9qj3

Uncontrolled resource consumption in Oracle Java SE and GraalVM JAXP

LOW 30

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00396 Published 2026-10-20 Partial fix CWE-400

TI-2026-77090 CVE-2026-83380 · GHSA-rcw5-53h9-w9g6

Information disclosure in Oracle Java SE

LOW 30

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAAS).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00325 Published 2026-10-20 Partial fix CWE-200

TI-2026-77453 CVE-2026-91394 · GHSA-fcqj-9fxv-7fq3

Sensitive information exposure in Oracle Java SE Networking

LOW 27

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking).

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00419 Published 2026-10-20 Partial fix CWE-200

TI-2026-77515 CVE-2026-91462 · GHSA-g364-xwwc-5hvh

Improper access control in Oracle Java SE JGSS component

LOW 26

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00274 Published 2026-10-20 Partial fix CWE-284

TI-2026-77131 CVE-2026-87290 · GHSA-p9mx-r8ww-77qq

Sensitive information exposure in Oracle Java SE JAXP component

LOW 26

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00327 Published 2026-10-20 Partial fix CWE-200

TI-2026-77097 CVE-2026-83387 · GHSA-jvp7-wjj3-pg66

Sensitive information exposure in Oracle Java SE JDBC component

LOW 26

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JDBC).

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00327 Published 2026-10-20 Partial fix CWE-200

TI-2026-77084 CVE-2026-83374 · GHSA-p25v-754r-q26h

Oracle Java SE and GraalVM information exposure in Security component

LOW 26

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00289 Published 2026-10-20 Partial fix CWE-200

TI-2026-77517 CVE-2026-91464 · GHSA-gj42-xjcm-wrr9

Use after free in Oracle Java SE JGSS component

LOW 24

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.00289 Published 2026-10-20 Partial fix CWE-416

TI-2026-77516 CVE-2026-91463 · GHSA-pq5q-77c8-hwjv

Use-after-free in Oracle Java SE JGSS component

LOW 23

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.00227 Published 2026-10-20 Partial fix CWE-416

TI-2026-77537 CVE-2026-91487 · GHSA-5f2x-x4h6-xw49

Improper access control in Oracle Java SE Compiler component

LOW 21

Vulnerability in Oracle Java SE (component: Compiler).

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00168 Published 2026-10-20 Partial fix CWE-284

TI-2026-77433 CVE-2026-91374 · GHSA-h6m7-6w4j-rx23

Improper access control in Oracle Java SE and GraalVM products

LOW 21

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serviceability).

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00168 Published 2026-10-20 Partial fix CWE-284

TI-2026-77091 CVE-2026-83381 · GHSA-wh8h-835p-j93v

Sensitive information exposure in Oracle Java SE Security component

LOW 21

Vulnerability in Oracle Java SE (component: Security).

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00226 Published 2026-10-20 Partial fix CWE-200

TI-2026-77088 CVE-2026-83378 · GHSA-rhj5-r5ww-65ff

Improper access control in Oracle Java SE Compiler component

LOW 21

Vulnerability in Oracle Java SE (component: Compiler).

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00214 Published 2026-10-20 Partial fix CWE-284

TI-2026-77438 CVE-2026-91379 · GHSA-53gh-9p66-w4f4

Use after free in Oracle Java SE and GraalVM JDK tools

LOW 20

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JDK tools).

CVSS 3.1MEDIUM 4.7 Local No auth User interaction EPSS 0.00122 Published 2026-10-20 Partial fix CWE-416

TI-2026-77434 CVE-2026-91375 · GHSA-r2p6-wxc8-pmpv

Incorrect authorization in Oracle Java SE Libraries component

LOW 20

Vulnerability in Oracle Java SE (component: Libraries).

CVSS 3.1MEDIUM 4.7 Local No auth User interaction EPSS 0.00092 Published 2026-10-20 Partial fix CWE-863

TI-2026-77514 CVE-2026-91461 · GHSA-hrmf-22mm-2484

Oracle Java SE and GraalVM JSSE improper certificate validation

LOW 17

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00187 Published 2026-10-20 Partial fix CWE-295

TI-2026-77439 CVE-2026-91380 · GHSA-qpg8-xfmg-2j85

Oracle Java SE and GraalVM Improper Access Control in Utility Component

LOW 17

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility).

CVSS 3.1MEDIUM 4.0 Local No auth No interaction EPSS 0.00097 Published 2026-10-20 Partial fix CWE-284

TI-2026-77393 CVE-2026-91334 · GHSA-x8mv-p396-jh2r

Oracle Java SE ImageIO flaw allows unauthorized read access

LOW 17

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00208 Published 2026-10-20 Partial fix CWE-200

TI-2026-77392 CVE-2026-91333 · GHSA-w3cp-rgcc-6q3q

Deserialization flaw in Oracle Java SE allows data changes

LOW 17

Vulnerability in Oracle Java SE (component: Security).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00265 Published 2026-10-20 Partial fix CWE-502

TI-2026-77207 CVE-2026-87367 · GHSA-m2mw-3v6r-66h4

Unauthorized data changes in Oracle Java SE JAXP component

LOW 17

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00252 Published 2026-10-20 Partial fix CWE-200

TI-2026-77133 CVE-2026-87292 · GHSA-wfmw-xhqr-83hm

Improper authentication in Oracle Java SE Networking component

LOW 17

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00239 Published 2026-10-20 Partial fix CWE-287

TI-2026-77086 CVE-2026-83376 · GHSA-cwrm-2mfc-rwqh

Oracle Java SE JSSE component flaw lets attackers alter data

LOW 17

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00252 Published 2026-10-20 Partial fix CWE-200

TI-2026-77456 CVE-2026-91397 · GHSA-xqpm-j9mr-99m8

Improper access control in Oracle Java SE and GraalVM products

LOW 16

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serviceability).

CVSS 3.1LOW 3.6 Local No auth User interaction EPSS 0.00095 Published 2026-10-20 Partial fix CWE-284

TI-2026-77459 CVE-2026-91400 · GHSA-52rv-2r96-ffhw

Uncontrolled resource consumption in Oracle Java SE Sound component

LOW 15

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound).

CVSS 3.1LOW 3.1 Network No auth User interaction EPSS 0.00257 Published 2026-10-20 Partial fix CWE-400

TI-2026-77394 CVE-2026-91335 · GHSA-jp97-m28p-vxx8

Information disclosure in Oracle Java SE AWT component

LOW 13

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT).

CVSS 3.1LOW 2.6 Network Low privileges User interaction EPSS 0.0021 Published 2026-10-20 Partial fix CWE-250