Alicja Kario discovered that the JSSE component of OpenJDK 11 incorrectly handled RSA padding. An Attacker could possibly use this issue to obtain sensitive information. (CVE-2025-21587) It was discovered that the Compiler component of OpenJDK 11 incorrectly handled compiler transformations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2025-30691) It was discovered that the 2D component of OpenJDK 11 did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2025-30698) In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2025-04-15

End of life: 9/16/2025, Latest version: 24

End of life: 3/18/2025, Latest version: 23.0.2

The OpenJDK 11 packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.<br>This release of the Red Hat build of OpenJDK 11 (11.0.24) for portable Linux serves as a replacement for the Red Hat build of OpenJDK 11 (11.0.23) and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section.<br>Security Fix(es):<br><li> OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147)</li> <li> OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131)</li> <li> OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138)</li> <li> OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140)</li> <li> OpenJDK: Pack200 increase loading time due to improper header validation (8322106) (CVE-2024-21144)</li> <li> OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A RangeCheckElimination array index overflow was found in OpenJDK.

Oracle CPU advisory - July 2024: https://www.oracle.com/security-alerts/cpujul2024.html#AppendixJAVA

An out-of-bounds access vulnerability was found in OpenJDK's 2D image handling.

Oracle CPU advisory - July 2024: https://www.oracle.com/security-alerts/cpujul2024.html#AppendixJAVA

Pack200 increase loading time due to improper header validation vulnerability in OpenJDK.

Oracle CPU advisory - July 2024: https://www.oracle.com/security-alerts/cpujul2024.html#AppendixJAVA

Range Check Elimination (RCE) pre-loop limit overflow vulnerability in OpenJDK.

Oracle CPU advisory - July 2024: https://www.oracle.com/security-alerts/cpujul2024.html#AppendixJAVA

Excessive symbol length can lead to an infinite loop vulnerability in OpenJDK.

Oracle CPU advisory - July 2024: https://www.oracle.com/security-alerts/cpujul2024.html#AppendixJAVA

A potential UTF8 size overflow vulnerability was found in OpenJDK.

Oracle CPU advisory - July 2024: https://www.oracle.com/security-alerts/cpujul2024.html#AppendixJAVA

A flaw was found in the Pack200 archive format in OpenJDK. The NativeUnpack class did not properly validate the memory size when allocating a buffer, potentially leading to an excessive memory allocation and denial of service condition.

A flaw was found in OpenJDK where a specially crafted long message in an Exception could lead to an application crash, resulting in a denial of service condition.

It was found that the ConnectionPool class implementation in the Networking/HTTP client component of OpenJDK improperly performs a reverse DNS query if the passed argument is an IP address, potentially sending a request over the wrong connection under certain conditions.

End of life: 9/17/2024, Latest version: 22.0.2

End of life: 9/17/2024, Latest version: 22.0.2

The OpenJDK 8 packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.<br>This release of the Red Hat build of OpenJDK 8 (8u402) for Windows serves as a replacement for the Red Hat build of OpenJDK 8 (8u392) and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section.<br>Security Fix(es):<br><li> OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918)</li> <li> OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952)</li> <li> OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919)</li> <li> OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921)</li> <li> OpenJDK: arbitrary Java code execution in Nashorn (8314284) (CVE-2024-20926)</li> <li> OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

It was discovered that the DOMRSAPSSSignatureMethod and DOMSignatureMethod classes in the Security component of OpenJDK could log private keys used for digital signature in debug logs, possibly leading the exposure of sensitive information to unstrusted parties.

It was discovered that the Libraries component in OpenJDK failed to properly handle ZIP archives that contain a file and directory entry with the same name within the ZIP file. This could lead to integrity issues when extracting data from such archives. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.

A flaw was found in the PKIX certification path validation algorithm in the JSSE component of OpenJDK. A malicious remote client could use this flaw to craft a X.509 certificate and cause denial of service in a Java application processing such certificate.

End of life: 3/19/2024, Latest version: 21.0.2

End of life: 3/19/2024, Latest version: 21.0.2

REJECT This CVE ID has been rejected by its CNA as it was not a security issue.

It was found that the ResponseBodyHandlers class implementation in the Networking/HTTP client component of OpenJDK failed to check for special characters embedded in file name parameters. A malicious user able to make a Java application perform an HTTP request to an attacker provided URL could use this flaw to possibly carry out a path traversal attack.

It was discovered that the implementation of ProcesBuilder in the Libraries component of OpenJDK did not correctly process NULL characters in command name attributes. This could lead to manipulation of command arguments when executing processes with arguments from untrusted sources.

An HTML validation flaw was found in the Swing component of OpenJDK. A specially crafted HTML document could cause a Swing Java application to misbehave leading to integrity problems.

It was discovered that the TLS implementation in the JSSE component of OpenJDK did not correctly handle half-duplex connections during TLS handshake. A remote attacker attacker could use this flaw to affect confidentiality or integrity of a TLS connection.

End of life: 9/19/2023, Latest version: 20.0.2

End of life: 9/19/2023, Latest version: 20.0.2

End of life: 3/21/2023, Latest version: 19.0.2

End of life: 3/21/2023, Latest version: 19.0.2