RHSA-2026:95609: Important: java-1.8.0-openjdk security update for RHEL 8
Important: java-1.8.0-openjdk security update for RHEL 8
Other sources
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.Security Fix(es): JDK: Enhance PKCS5 padding (CVE-2026-83374) JDK: Enhance TLS certificate handling (CVE-2026-83376) JDK: Enhance LDAP logins (CVE-2026-83380) JDK: Enhance SASL Authentication (CVE-2026-83381) JDK: Enhance WebRowSets (CVE-2026-83387) JDK: Enhance HTTP Client Response Handling (CVE-2026-83395) JDK: Enhance Certificate Name Checks (CVE-2026-87294) JDK: Enhance XPath Expressions (CVE-2026-87290) JDK: Enhance Network Clients (CVE-2026-87292) JDK: Enhance RMI connections (CVE-2026-87293) JDK: Enhance Certificate Constraint Checking (CVE-2026-101516) JDK: Enhance XML Processing (CVE-2026-83400) JDK: Enhance JPEG loading (CVE-2026-91334) JDK: Enhance Template Handling (CVE-2026-87367) JDK: Enhance Image Handling (CVE-2026-91335) JDK: Enhance Preferences (CVE-2026-91380) JDK: Enhance TLS handshakes (CVE-2026-91373) JDK: Enhance Font Rendering (CVE-2026-91381) JDK: Enhance Image Processing (CVE-2026-91382) JDK: Enhance jstatd (CVE-2026-91374) JDK: Enhance Pack200 unpacking (CVE-2026-91395) JDK: Improve Pack200 handling (CVE-2026-91396) JDK: Enhance diagnostic sessions (CVE-2026-91397) JDK: Enhance SOCKS5 support (CVE-2026-91398) JDK: Enhance MIDI file handling (CVE-2026-91400) JDK: Enhance zipfs (CVE-2026-91410) JDK: Enhance JGSS (CVE-2026-91411) JDK: Enhance CORBA (CVE-2026-91417) JDK: Enhance font rendering (CVE-2026-91415) JDK: Enhance HTTP server parsing (CVE-2026-91451) JDK: Enhance HTTP Server Handler (CVE-2026-91452) JDK: Improve HTTP headers (CVE-2026-91453) JDK: Enhance GIF loading (CVE-2026-91418) JDK: Enhance TLS Extensions (CVE-2026-91461) JDK: Enhance krb5 tokens (CVE-2026-91462) JDK: Enhance krb5 client (CVE-2026-91463) JDK: Enhance Kerberos validation (CVE-2026-91464) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Note that the OpenJDK RPMs use the system certificate repository rather than one provided by OpenJDK. For updates to remove the compromised eMudhra certificates, please update the ca-certificates package.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-accessibility-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-debuginfo-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-debugsource-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-demo-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-demo-debuginfo-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-devel-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-devel-debuginfo-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-headless-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-headless-debuginfo-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-javadoc-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-javadoc-zip-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-src-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-demo-fastdebug-debuginfo-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-devel-fastdebug-debuginfo-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-fastdebug-debuginfo-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-headless-fastdebug-debuginfo-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-slowdebug-debuginfo-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-accessibility-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-debuginfo-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-debugsource-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-demo-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-demo-debuginfo-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-devel-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-devel-debuginfo-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-headless-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-headless-debuginfo-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-src-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-accessibility-fastdebug-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-accessibility-slowdebug-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-demo-fastdebug-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-demo-slowdebug-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-devel-fastdebug-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-devel-slowdebug-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-fastdebug-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-headless-fastdebug-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-headless-slowdebug-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-slowdebug-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-src-fastdebug-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-src-slowdebug-1.8.0.512.b09-1.2.el8 - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-accessibility-fastdebug-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-accessibility-slowdebug-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-demo-fastdebug-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-demo-fastdebug-debuginfo-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-demo-slowdebug-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-demo-slowdebug-debuginfo-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-devel-fastdebug-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-devel-fastdebug-debuginfo-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-devel-slowdebug-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-devel-slowdebug-debuginfo-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-fastdebug-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-fastdebug-debuginfo-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-headless-fastdebug-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-headless-fastdebug-debuginfo-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-headless-slowdebug-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-headless-slowdebug-debuginfo-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-slowdebug-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-slowdebug-debuginfo-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-src-fastdebug-1.8.0.512.b09-1.2.el8.aa - Upgrade
Upgrade
redhat/javato a version that resolves this vulnerability.Fixed in 1.8.0-openjdk-src-slowdebug-1.8.0.512.b09-1.2.el8.aa
Event History
Frequently Asked Questions
Which systems should be prioritized for this update?
Prioritize RHEL 8 systems that have java-1.8.0-openjdk installed, particularly deployments that use Java TLS, LDAP, SASL, RMI, XML, HTTP client, image-processing, or certificate-validation functionality. The listed affected offerings include x86_64, ARM 64, IBM z Systems Extended Life Cycle, Server TUS/AUS, and CodeReady Linux Builder variants.
What attack surfaces are implicated by the fixes?
The fixes cover multiple Java runtime components, including TLS handshakes and certificate processing, LDAP and SASL authentication, RMI and network clients, HTTP response handling, XML/XPath and WebRowSet processing, and image, JPEG, font, and template handling. Exposure depends on whether deployed Java applications use the affected component and process attacker-controlled network data or files.
How can I determine whether a host needs remediation?
Identify RHEL 8 hosts with the java-1.8.0-openjdk packages installed and compare their installed package state against the updated packages provided by RHSA-2026:95609. The supplied information does not include fixed package version numbers.