An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low availability impact using unknown attack vectors.

A flaw was found in the way the GssKrb5Base class in the Security component of OpenJDK validated properties of SASL messages included in Kerberos GSSAPI, omitting required token checks. An remote attacker with ability to manipulate network traffic between server and client using Kerberos GSSAPI could possibly perform message modification that would not be detected during message decoding.

A flaw was found in the what the BeanContextSupport class in the Serialization component of OpenJDK handled exceptions during deserialization. A specially-crafted input could cause a Java application to use an excessive amount of resources when deserialized.

A flaw was found in the Linux kernel. The generation of the device ID from the network RNG internal state is predictable. The highest threat from this vulnerability is to data confidentiality.

Last updated 9 September 2026