java-17-openjdk-17.0.19.0.10-2.el9.ML.1

エラータID: AXSA:2026-599:08

Release date: 
Tuesday, May 12, 2026 - 10:33
Subject: 
java-17-openjdk-17.0.19.0.10-2.el9.ML.1
Affected Channels: 
MIRACLE LINUX 9 for x86_64
Severity: 
High
Description: 

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and
the OpenJDK 17 Java Software Development Kit.

Security Fix(es):

JDK: Enhance crypto algorithm support (CVE-2026-22007)
JDK: Improve Kerberos credentialing (CVE-2026-22013)
JDK: Enhance Path Factories Redux (CVE-2026-22016)
JDK: Enhance Zip file reading (CVE-2026-22018)
JDK: Enhance certificate chain validation (CVE-2026-22021)
JDK: Updating FreeType 2.14.1 (CVE-2026-23865)
JDK: Enhance TLS connection handling (CVE-2026-34282)
JDK: Enhance key generation (CVE-2026-34268)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

CVE(s):
CVE-2026-22007
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVE-2026-22013
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).
CVE-2026-22016
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVE-2026-22018
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVE-2026-22021
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVE-2026-23865
An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.
CVE-2026-34268
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVE-2026-34282
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Solution: 

Update packages.

Additional Info: 

N/A

Download: 

SRPMS
  1. java-17-openjdk-17.0.19.0.10-2.el9.ML.1.src.rpm
    MD5: f1f519b1048d068a9583de2c5d36013e
    SHA-256: 2fad211e45c3872647bea062d0608e031b256124027964ebb3d5ce53c703d86b
    Size: 64.25 MB

Asianux Server 9 for x86_64
  1. java-17-openjdk-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: d10a06d69a3b4eb28d2f730716a1548d
    SHA-256: bfbcbe2a0926c3c5e1d4ad2c78af26b1e6ffa9e207a06508b54ff59f9189205c
    Size: 429.44 kB
  2. java-17-openjdk-demo-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: 6a36df0540c60588a19b9ec43edf3bcf
    SHA-256: ffc31d7f6c0776a9f462fecc5cc5ba688fba31bd063c83af16fb09c85b29a675
    Size: 3.43 MB
  3. java-17-openjdk-demo-fastdebug-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: 9465efd0c66bea0625447a9e0c7ee99b
    SHA-256: 77fca17d7e57442d12cb51ae83c8411802fdeaddbd890adc6ff265250b6958eb
    Size: 3.43 MB
  4. java-17-openjdk-demo-slowdebug-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: f8fe9be673ac4d476f47dfb1ba5b3fe8
    SHA-256: 1cd9976ef4893ff65d4f790cefb9b855480149b3ceac9f45ae792997f78b4d75
    Size: 3.43 MB
  5. java-17-openjdk-devel-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: 7590e36131b3bd16db43ceec55d0a4cd
    SHA-256: ffc857b5112f294db3b085a5bc065604d9035010a7abf8dbe8142999548e76c2
    Size: 4.72 MB
  6. java-17-openjdk-devel-fastdebug-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: b7caf0f7065935e20454ebe943a17053
    SHA-256: 190072b5fcb33705e5ee507b2ebb265146ffd3b7e98b1399f2946aca34d51419
    Size: 4.72 MB
  7. java-17-openjdk-devel-slowdebug-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: f2092a43ecdb20fd2712007469301f87
    SHA-256: fbc4c8f47d1ce69f64b5542382990248776d6854ead5358d2e23e924abcefa79
    Size: 4.72 MB
  8. java-17-openjdk-fastdebug-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: f592d396c951813852d44c708b12e955
    SHA-256: 9e931415d63d5642256a90ae8f5e4d5eff75b3f7769ecdf515fc91938b438ebe
    Size: 438.56 kB
  9. java-17-openjdk-headless-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: 1e2aa2304e6fb4a0073d33742d13a2b3
    SHA-256: 51b37a82238c8f22143f39a270cb79ea6ff441e1c6a68303b446399b18c3ada1
    Size: 44.35 MB
  10. java-17-openjdk-headless-fastdebug-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: f53b531b5f68519d3f369ed2d93597e3
    SHA-256: 34330597dcb9a21bfdf174b87ee42526bf9cbbb131589a059128b63e7cd07ce0
    Size: 49.31 MB
  11. java-17-openjdk-headless-slowdebug-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: 56736f2a6af3160fb5ec0618354d81d0
    SHA-256: 1f0a77abb351f0e438268a7e5ed9c93c12ffbf5a3d0df74518b003aa6f553276
    Size: 46.11 MB
  12. java-17-openjdk-javadoc-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: 1ba50d4f9501c52c5c0af807b90ecbae
    SHA-256: 2386faa6f4edab74b5bd419664b6ad56a2cdb869d9a66dbda560a5e187a087cb
    Size: 14.69 MB
  13. java-17-openjdk-javadoc-zip-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: f22324cc21ed2dbd255afd218aa6e5fe
    SHA-256: ef559b13eea4b43272cc47f0a13775308cccb254b9d075b51a2bd7439d5a4e39
    Size: 39.50 MB
  14. java-17-openjdk-jmods-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: ce53de7a06875594899af08122fcd97c
    SHA-256: 1d2f194fad21a643766ee9cd79e06bf12b7937153457a7734f460bdaa2e6a3d3
    Size: 246.16 MB
  15. java-17-openjdk-jmods-fastdebug-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: b653a5c1d2f7e29a0ee91be712085ff9
    SHA-256: 2167c4f40431cef3656d0ed7b79aa7e5a8511002386b730f7003142ee512004a
    Size: 244.62 MB
  16. java-17-openjdk-jmods-slowdebug-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: 7f7c69f71853854e381d4038d61db078
    SHA-256: 9fc1f62f24bc2101f6692b3f4af728e47ea70d448049ec7b6a0619d999ca36c6
    Size: 174.55 MB
  17. java-17-openjdk-slowdebug-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: d34b481e030ce2fce3a23f369bc907b3
    SHA-256: 5d027a28a1898932b50cee45ec57493073b3d51574e173fed6c4841085c61d3d
    Size: 409.07 kB
  18. java-17-openjdk-src-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: aee41e880c612964315aae7825541180
    SHA-256: c0393266b64b62db89f3940af5e3499904b410012f5af92eadd342ba249edb51
    Size: 44.92 MB
  19. java-17-openjdk-src-fastdebug-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: a8f629ce2de582dea6a1a576d44a1260
    SHA-256: 5a896ba73c9433f9e93e3ee63747b139f3e899b0035c89f719f555ea01fa8dab
    Size: 44.93 MB
  20. java-17-openjdk-src-slowdebug-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: 9cf6c6219ac5a2c90c97c79714b6fc17
    SHA-256: 0b84ace3e28731197d6ff3f78b123baec3dfdbc3d3194af30632b05d9ede1f33
    Size: 44.93 MB
  21. java-17-openjdk-static-libs-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: 71975f20bb3c2c9a915d6160f09aede5
    SHA-256: 44c6af4d8d9d71c53206528a14b991d1bd4792344a3666c64141bae5900f7e1a
    Size: 29.00 MB
  22. java-17-openjdk-static-libs-fastdebug-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: fca722a70d2dc116cfada72025e1b338
    SHA-256: 76a7eafa4a5d7f666ea33038da36edf377722c7e0c01c7974b0b407420a84bcc
    Size: 29.07 MB
  23. java-17-openjdk-static-libs-slowdebug-17.0.19.0.10-2.el9.ML.1.x86_64.rpm
    MD5: 9c880e198f73629c6bf1992e383f16a6
    SHA-256: 14b3445273a64868e86cbac119dd5d7e6955e966df90a4492e62a62e3e1a1e26
    Size: 22.67 MB