A flaw was found in the Utility component of OpenJDK. The Multi-Release attribute could have been read from outside of the main attributes in a Jar manifest, possibly leading to a use of an unsigned value for this attribute. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.

It was discovered that the Security component of OpenJDK could incorrectly use unsigned manifest attribute entries when only properly signed entries were meant to be used. This could lead to bypass of protections provided by Jar signing. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.

An information leak flaw was found in the Networking component of OpenJDK. The HttpURLConnection class implementation could re-send HTTP headers containing sensitive data (such as Cookie or Authorization headers) to a different host when following HTTP redirects. This could lead to exposure of data to unintended HTTP hosts.