Red Hat Security Advisory

RHSA-2026:9693

java-25-openjdk security update

Released 2026-04-22 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) java-25-openjdk-1:25.0.3.0.9-1.el10_2, java-25-openjdk-crypto-adapter-1:25.0.3.0.9-1.el10_2, java-25-openjdk-demo-1:25.0.3.0.9-1.el10_2 +7
Red Hat Enterprise Linux AppStream (v. 9) java-25-openjdk-1:25.0.3.0.9-1.el9, java-25-openjdk-crypto-adapter-1:25.0.3.0.9-1.el9, java-25-openjdk-demo-1:25.0.3.0.9-1.el9 +7
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) java-25-openjdk-crypto-adapter-fastdebug-1:25.0.3.0.9-1.el10_2, java-25-openjdk-crypto-adapter-slowdebug-1:25.0.3.0.9-1.el10_2, java-25-openjdk-demo-fastdebug-1:25.0.3.0.9-1.el10_2 +13
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) java-25-openjdk-crypto-adapter-fastdebug-1:25.0.3.0.9-1.el9, java-25-openjdk-crypto-adapter-slowdebug-1:25.0.3.0.9-1.el9, java-25-openjdk-demo-fastdebug-1:25.0.3.0.9-1.el9 +13

Fixes 12 records

TI-2026-21378 CVE-2026-26740 · GHSA-g43h-fmhp-fvff

Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a…

HIGH 75

Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphic Control Extension block without validating its allocated si…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00657 Published 2026-03-18 Partial fix CWE-787

TI-2026-26571 CVE-2026-34282 · GHSA-hpm9-74qx-6x32

Uncontrolled resource consumption in Oracle Java SE

MEDIUM 40

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00635 Published 2026-04-21 Partial fix CWE-400

TI-2026-17711 CVE-2026-22016 · GHSA-9m62-hmpm-rr2m

Information disclosure in Oracle Java SE

MEDIUM 40

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00702 Published 2026-04-21 Partial fix CWE-200

TI-2026-25813 CVE-2026-33416

LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`

LOW 37

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.01071 Published 2026-03-26 Partial fix · 1.6.56 CWE-416

TI-2026-26017 CVE-2026-33636

LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64

LOW 35

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

CVSS 3.1HIGH 7.6 Network No auth User interaction EPSS 0.00751 Published 2026-03-26 Partial fix · 1.6.56 CWE-125

TI-2026-17715 CVE-2026-22021 · GHSA-9grw-5h83-65p3

Uncontrolled resource consumption in Oracle Java SE

LOW 30

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00305 Published 2026-04-21 Partial fix CWE-400

TI-2026-17708 CVE-2026-22013 · GHSA-75hh-423h-rvwg

Protection mechanism failure in Oracle Java SE

LOW 24

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.00258 Published 2026-04-21 Partial fix CWE-693

TI-2026-19226 CVE-2026-23865 · GHSA-878v-mxg6-vj8f

Out-of-bounds read in FreeType

LOW 23

An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType vari…

CVSS 3.1MEDIUM 5.3 Local No auth User interaction EPSS 0.00166 Published 2026-03-02 Partial fix CWE-125

TI-2026-17713 CVE-2026-22018 · GHSA-376j-8f52-gp2x

Resource allocation without limits in Oracle Java SE

LOW 17

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00269 Published 2026-04-21 Partial fix CWE-770

TI-2026-17704 CVE-2026-22008 · GHSA-ffgj-wmrh-m8fr

Vulnerability in Oracle Java SE (component: Libraries).

LOW 17

Vulnerability in Oracle Java SE (component: Libraries).

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00206 Published 2026-04-21 Partial fix CWE-250

TI-2026-26557 CVE-2026-34268 · GHSA-xvmr-9p7m-jmwv

Information disclosure in Oracle Java SE

LOW 13

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).

CVSS 3.1LOW 2.9 Local No auth No interaction EPSS 0.00122 Published 2026-04-21 Partial fix CWE-200

TI-2026-17703 CVE-2026-22007 · GHSA-rj5j-26xx-hh3v

Information disclosure in Oracle Java SE

LOW 13

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).

CVSS 3.1LOW 2.9 Local No auth No interaction EPSS 0.00124 Published 2026-04-21 Partial fix CWE-200