It was discovered that the DnsClient client class in the JNDI (Java Naming and Directory Interface) component in OpenJDK failed to properly remove information about an outgoing DNS request from the list of outstanding DNS requests when certain errors occurred during DNS resolution. An attacker able to trigger such DNS errors could cause a Java application using JNDI to consume memory and possibly block further DNS resolution (after exhausting all DNS transaction ids).

It was discovered that the JCE (Java Cryptography Extension) component in OpenJDK failed to use constant time comparisons in multiple cases. An attacker could possibly use these flaws to disclose sensitive information by measuring time used to perform operations using these non-constant time comparisons.