USN-9009-1: openjdk-8 vulnerabilities
It was discovered that the Security component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374)
It was discovered that the JSSE component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83376, CVE-2026-91461)
It was discovered that the JAAS component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83380)
It was discovered that the Security component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-83381, CVE-2026-87294)
It was discovered that the JDBC component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83387)
It was discovered that the Networking component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-83395)
It was discovered that the JAXP component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-83400)
It was discovered that the JAXP component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-87290)
It was discovered that the Networking component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87292, CVE-2026-91451, CVE-2026-91452)
It was discovered that the RMI component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-87293)
It was discovered that the JAXP component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87367)
It was discovered that the ImageIO component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91334)
It was discovered that the AWT component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91335)
It was discovered that the JSSE component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91373)
It was discovered that the Serviceability component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91374)
It was discovered that the Utility component of OpenJDK 8 did not correctly authorize users. A local attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91380)
It was discovered that the 2D component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91381)
It was discovered that the 2D component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91382)
It was discovered that the Utility component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91395, CVE-2026-91396)
It was discovered that the Serviceability component of OpenJDK 8 did not correctly authorize users. A local attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91397)
It was discovered that the Networking component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91398)
It was discovered that the Sound component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91400)
It was discovered that the JSSE component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91403)
It was discovered that the Libraries component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91410)
It was discovered that the JGSS component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91411)
It was discovered that the 2D component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to read or modify sensitive data. (CVE-2026-91415)
It was discovered that the CORBA component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91417)
It was discovered that the ImageIO component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91418)
It was discovered that the Lightweight HTTP Server component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91453)
It was discovered that the JGSS component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91462)
It was discovered that the JGSS component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91463, CVE-2026-91464)
It was discovered that the Security component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-114820)
In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.
Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2026-10-20 https://openjdk.org/groups/vulnerability/advisories/2026-10-21 https://openjdk.org/groups/vulnerability/advisories/2026-10-24
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~16.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~18.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~20.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~22.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~24.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~26.04.1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
- CVE-2026-83374
- CVE-2026-83376
- CVE-2026-83380
- CVE-2026-83381
- CVE-2026-83387
- CVE-2026-83395
- CVE-2026-83400
- CVE-2026-87290
- CVE-2026-87292
- CVE-2026-87293
- CVE-2026-87294
- CVE-2026-87367
- CVE-2026-91334
- CVE-2026-91335
- CVE-2026-91373
- CVE-2026-91374
- CVE-2026-91380
- CVE-2026-91381
- CVE-2026-91382
- CVE-2026-91395
- CVE-2026-91396
- CVE-2026-91397
- CVE-2026-91398
- CVE-2026-91400
- CVE-2026-91403
- CVE-2026-91410
- CVE-2026-91411
- CVE-2026-91415
- CVE-2026-91417
- CVE-2026-91418
- CVE-2026-91451
- CVE-2026-91452
- CVE-2026-91453
- CVE-2026-91461
- CVE-2026-91462
- CVE-2026-91463
- CVE-2026-91464
- UBUNTU-CVE-2026-83374
- UBUNTU-CVE-2026-83376
- UBUNTU-CVE-2026-83380
- UBUNTU-CVE-2026-83381
- UBUNTU-CVE-2026-83387
- UBUNTU-CVE-2026-83395
- UBUNTU-CVE-2026-83400
- UBUNTU-CVE-2026-87290
- UBUNTU-CVE-2026-87292
- UBUNTU-CVE-2026-87293
- UBUNTU-CVE-2026-87294
- UBUNTU-CVE-2026-87367
- UBUNTU-CVE-2026-91334
- UBUNTU-CVE-2026-91335
- UBUNTU-CVE-2026-91373
- UBUNTU-CVE-2026-91374
- UBUNTU-CVE-2026-91380
- UBUNTU-CVE-2026-91381
- UBUNTU-CVE-2026-91382
- UBUNTU-CVE-2026-91395
- UBUNTU-CVE-2026-91396
- UBUNTU-CVE-2026-91397
- UBUNTU-CVE-2026-91398
- UBUNTU-CVE-2026-91400
- UBUNTU-CVE-2026-91403
- UBUNTU-CVE-2026-91410
- UBUNTU-CVE-2026-91411
- UBUNTU-CVE-2026-91415
- UBUNTU-CVE-2026-91417
- UBUNTU-CVE-2026-91418
- UBUNTU-CVE-2026-91451
- UBUNTU-CVE-2026-91452
- UBUNTU-CVE-2026-91453
- UBUNTU-CVE-2026-91461
- UBUNTU-CVE-2026-91462
- UBUNTU-CVE-2026-91463
- UBUNTU-CVE-2026-91464
Frequently Asked Questions
Is local access identified as a prerequisite for exploitation?
No. The notice describes these issues as potentially exploitable by a remote attacker; it does not identify local access as a requirement.
Which issues could allow modification of sensitive data?
Potential modification of sensitive data is reported for CVE-2026-83374 in the Security component; CVE-2026-83376 and CVE-2026-91461 in JSSE; CVE-2026-83381 and CVE-2026-87294 in the Security component; and CVE-2026-83395 in Networking.
Which issues are associated with exposure of sensitive data?
CVE-2026-83380 in JAAS could allow a remote attacker to read sensitive data. CVE-2026-83381 and CVE-2026-87294 in Security could allow reading or modifying sensitive data, while CVE-2026-83387 in JDBC could allow reading sensitive data.
Is denial of service a reported impact?
Yes. CVE-2026-83395, affecting the Networking component, could allow a remote attacker to cause a denial of service or modify sensitive data.