java-21-openjdk-21.0.11.0.10-2.el9.ML.1
エラータID: AXSA:2026-605:06
The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the
OpenJDK 21 Java Software Development Kit.
Security Fix(es):
JDK: Enhance crypto algorithm support (CVE-2026-22007)
JDK: Improve Kerberos credentialing (CVE-2026-22013)
JDK: Enhance Path Factories Redux (CVE-2026-22016)
JDK: Enhance Zip file reading (CVE-2026-22018)
JDK: Enhance certificate chain validation (CVE-2026-22021)
JDK: Updating FreeType 2.14.1 (CVE-2026-23865)
JDK: Enhance TLS connection handling (CVE-2026-34282)
JDK: Enhance key generation (CVE-2026-34268)
Bug Fix(es):
When copying files, OpenJDK 21 prefers to use the copy_file_range native
function for performance reasons, only falling back to sendfile when this fails.
However, in previous OpenJDK 21 releases, a response of EOPNOTSUPP (operation
not supported) did not cause the JDK to fall back to sendfile. This is rectified
in this release. (RHEL-169617, RHEL-169951, RHEL-169952, RHEL-169942,
RHEL-169953, RHEL-169945)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.
CVE(s):
CVE-2026-22007
CVE-2026-22013
CVE-2026-22016
CVE-2026-22018
CVE-2026-22021
CVE-2026-23865
CVE-2026-34268
CVE-2026-34282
Update packages.
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle GraalVM for JDK: 17.0.18 and 21.0.10; Oracle GraalVM Enterprise Edition: 21.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 2.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
N/A
SRPMS
- java-21-openjdk-21.0.11.0.10-2.el9.ML.1.src.rpm
MD5: e1ab8d75fcada28cfaf006293d722829
SHA-256: 5ea8ce4d9620ee20314e8977bf3aba2040d0038d30021912709e348c25a597ff
Size: 67.94 MB
Asianux Server 9 for x86_64
- java-21-openjdk-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: 0c9f3c9dee833dc0936e8593331039f2
SHA-256: db57f52b13f272fa4038bb6ea96da876c784aa3ad4dc8ef5ed083bd141dcff1d
Size: 397.15 kB - java-21-openjdk-demo-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: f2414a38573653b89530e1256e5db7e0
SHA-256: ae0c484602a172703fb2f7ab6f77204cb2eaa4e9c23d016dcdb5fe436c7be50a
Size: 3.19 MB - java-21-openjdk-demo-fastdebug-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: 7f6dff10221216fe86010158ea4c2cb5
SHA-256: b9abbe5a9b04c1b9a6af25d187fa216e5b3a702805c5d528264284cc49dd59fa
Size: 3.19 MB - java-21-openjdk-demo-slowdebug-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: b672ead789b9d5b62e627393ba10360e
SHA-256: 9c6876cb7a3a4a5f85bd28a4b91690ae7889443ee6c39dcc4e102dc30d98bbf4
Size: 3.19 MB - java-21-openjdk-devel-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: 3c37e8bee5d0d052cf59b54d1884c2f1
SHA-256: 708965f60c763fb0f14d5e54c204ee32f57dd3b620ee5ed1a84be285377c077f
Size: 5.00 MB - java-21-openjdk-devel-fastdebug-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: 3765d24168da0b6e256c6b90d955b873
SHA-256: 226b8b955f90abc4d8ccb582366b48d91ca9e6dfc2534b91f4321288804060da
Size: 5.00 MB - java-21-openjdk-devel-slowdebug-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: 58a1d158d6dcc286f958f53c551c210a
SHA-256: 951d5b13825f7903e73ce82709337975763339f0e22e9770f31ae9ce1477b469
Size: 5.00 MB - java-21-openjdk-fastdebug-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: dedc850747db89b8075333965a66c08a
SHA-256: d065a23ebb29b01e0d6e81b499ee0d9f3302739e5292922c35a7cd1312c634b7
Size: 406.42 kB - java-21-openjdk-headless-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: b37f9f7b7dc1d379abdd370fde8f0dca
SHA-256: 6ebc4362a1f7df8263f88d9a7a3d108650cbfb5be6951a6f03097a5343217965
Size: 47.50 MB - java-21-openjdk-headless-fastdebug-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: c4ddb567aae53e0b47b55b1124659af9
SHA-256: 6ebd1daed851ef29eee0165dc71330875b14eaadfb9b19dafe08d23b3eaa51c4
Size: 52.01 MB - java-21-openjdk-headless-slowdebug-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: 4f3d0ea2598e4f5ae5c9e74ee0b0c8c9
SHA-256: 80993ee3792ed6707a2c63ac0cdf6d86bcd8ae59a85d2ce820d69f12e510ebf2
Size: 50.09 MB - java-21-openjdk-javadoc-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: 195dcd4ac3c27835aa47f6a83a4eedfc
SHA-256: 836c0ae5ec3c90a998c0d50cfe7933d0f8ffd8826d13d28ffe3e5a99eead70ca
Size: 14.99 MB - java-21-openjdk-javadoc-zip-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: 97285a672384f2e93aa131ce84ea6860
SHA-256: 3b933e1d73b776b53c299da59c085fb295f8efe6ad47bdf9c78d811535f9e79c
Size: 40.63 MB - java-21-openjdk-jmods-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: 208b558b6a4e446bd08d74eaefa17f15
SHA-256: 509f58ca66b990da72097ef7048ad5b72a52610bdbfa624b1504fd1d3f5fc437
Size: 303.88 MB - java-21-openjdk-jmods-fastdebug-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: 941a1e9dadafbecd9cb0c53c2c575cce
SHA-256: 313a2ef252ab3b6992fb02c4cd719fd0fb2f16e589c0fb5a84d5764008e4acd7
Size: 355.04 MB - java-21-openjdk-jmods-slowdebug-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: 11704ca43f372512385154713df53587
SHA-256: 5a55bf87c9bec93c34212a583926a5d7fbf2872e1a99f9bca434dfe7191e1309
Size: 270.10 MB - java-21-openjdk-slowdebug-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: 047176dd64802a30ef67b260b0da9053
SHA-256: d8bff1070ab2ef128036af9d904e353b4f6fd4778dcfccab2e7e54daae424beb
Size: 406.09 kB - java-21-openjdk-src-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: 5511868a3edc18d7cd14b24c13ad0d5c
SHA-256: 05bd8f55ff977673ea7c3b193fc5aca7f52089cd21bf5aa9fc8e630676319168
Size: 46.80 MB - java-21-openjdk-src-fastdebug-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: b5540d22295f8110139179c5964989c2
SHA-256: 09c04635c275a4624743f4d36ef654205a60badc188af874099be979842030de
Size: 46.80 MB - java-21-openjdk-src-slowdebug-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: 0ff793fe6868de4d74a23fa2427ba5d4
SHA-256: 2cb1631b17549ef0890e8b7e1f8ddc41aac7b7da942537fba4acbc7ed2e55abc
Size: 46.80 MB - java-21-openjdk-static-libs-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: 05e537e10aefd4c835eb78218ea95ae4
SHA-256: 8553d268d0537e711cc85d7df772327785878f27e49ad15f38e7732a52061f1b
Size: 31.13 MB - java-21-openjdk-static-libs-fastdebug-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: 55a56c28a606df14c750f400176cae5f
SHA-256: f6b9129aeb6ab1c93cf049fa143b4a9e7a03d9f47ae016a27c94a17a50492551
Size: 31.44 MB - java-21-openjdk-static-libs-slowdebug-21.0.11.0.10-2.el9.ML.1.x86_64.rpm
MD5: 7a631e1273dc06269c335c9f962f7e6f
SHA-256: ba097a8400e241178c6d3dbf8a366a19f1d46b44684a90631939884a6e2d7652
Size: 22.39 MB