RHSA-2026:88350CriticalCVSS 8.1

Red Hat Security Advisory: OpenJDK 21.0.13 Security Update for Portable Linux Builds

Published
October 29, 2026
Last Modified
November 3, 2026

🔗 CVE IDs covered (41)

CVE-2026-83395 →CVE-2026-87291 →CVE-2026-87292 →CVE-2026-87367 →CVE-2026-83376 →CVE-2026-83378 →CVE-2026-91415 →CVE-2026-91452 →CVE-2026-91400 →CVE-2026-91403 →CVE-2026-91453 →CVE-2026-91461 →CVE-2026-91398 →CVE-2026-83380 →CVE-2026-83387 →CVE-2026-91332 →CVE-2026-91334 →CVE-2026-91335 →CVE-2026-91380 →CVE-2026-91382 →CVE-2026-83400 →CVE-2026-87290 →CVE-2026-91375 →CVE-2026-91397 →CVE-2026-91410 →CVE-2026-91418 →CVE-2026-91451 →CVE-2026-91462 →CVE-2026-91373 →CVE-2026-91394 →CVE-2026-91464 →CVE-2026-101516 →CVE-2026-114820 →CVE-2026-83374 →CVE-2026-87294 →CVE-2026-91333 →CVE-2026-91374 →CVE-2026-91463 →CVE-2026-91487 →CVE-2026-83381 →CVE-2026-91379 →

📋 Description

CVE-2026-83374 — openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10) CVE-2026-83376 — openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10) CVE-2026-83378 — openjdk: Improve C2 loop transformations (Oracle CPU 2026-10) CVE-2026-83380 — openjdk: Enhance LDAP logins (Oracle CPU 2026-10) CVE-2026-83381 — openjdk: Enhance SASL Authentication (Oracle CPU 2026-10) CVE-2026-83387 — openjdk: Enhance WebRowSets (Oracle CPU 2026-10) CVE-2026-83395 — openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10) CVE-2026-83400 — openjdk: Enhance XML Processing (Oracle CPU 2026-10) CVE-2026-87290 — openjdk: Enhance XPath Expressions (Oracle CPU 2026-10) CVE-2026-87291 — openjdk: Enhance HTTP Server (Oracle CPU 2026-10) CVE-2026-87292 — openjdk: Enhance Network Clients (Oracle CPU 2026-10) CVE-2026-87294 — openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10) CVE-2026-87367 — openjdk: Enhance Template Handling (Oracle CPU 2026-10) CVE-2026-91332 — openjdk: Enhance HTTP Client (Oracle CPU 2026-10) CVE-2026-91333 — openjdk: Improve ciphertext handling (Oracle CPU 2026-10) CVE-2026-91334 — openjdk: Enhance JPEG loading (Oracle CPU 2026-10) CVE-2026-91335 — openjdk: Enhance Image Handling (Oracle CPU 2026-10) CVE-2026-91373 — openjdk: Enhance TLS handshakes (Oracle CPU 2026-10) CVE-2026-91374 — openjdk: Enhance jstatd (Oracle CPU 2026-10) CVE-2026-91375 — openjdk: Enhance jmod handling (Oracle CPU 2026-10) CVE-2026-91379 — openjdk: Enhance JShell (Oracle CPU 2026-10) CVE-2026-91380 — openjdk: Enhance Preferences (Oracle CPU 2026-10) CVE-2026-91382 — openjdk: Enhance Image Processing (Oracle CPU 2026-10) CVE-2026-91394 — openjdk: Enhance HTTP client caching (Oracle CPU 2026-10) CVE-2026-91397 — openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10) CVE-2026-91398 — openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10) CVE-2026-91400 — openjdk: Enhance MIDI file handling (Oracle CPU 2026-10) CVE-2026-91403 — OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-91410 — openjdk: Enhance zipfs (Oracle CPU 2026-10) CVE-2026-91415 — openjdk: Enhance font rendering (Oracle CPU 2026-10) CVE-2026-91418 — openjdk: Enhance GIF loading (Oracle CPU 2026-10) CVE-2026-91451 — openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10) CVE-2026-91452 — openjdk: Enhance HTTP server (Oracle CPU 2026-10) CVE-2026-91453 — openjdk: Improve HTTP headers (Oracle CPU 2026-10) CVE-2026-91461 — openjdk: Enhance TLS Extensions (Oracle CPU 2026-10) CVE-2026-91462 — openjdk: Enhance krb5 tokens (Oracle CPU 2026-10) CVE-2026-91463 — openjdk: Enhance krb5 client (Oracle CPU 2026-10) CVE-2026-91464 — openjdk: Enhance Kerberos validation (Oracle CPU 2026-10) CVE-2026-91487 — openjdk: Enhance C2 comparisons (Oracle CPU 2026-10) CVE-2026-101516 — openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10) CVE-2026-114820 — OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns

🎯 Affected products1

  • Red Hat Build of OpenJDK 21.0.12.1

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: See the security bulletin for a detailed mitigation procedure. Workaround: --- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to distrust or remove affected eMudhra-related root CA certificates from the Java trust store and enforce certificate pinning: upgrade to the fixed Java 17 Openjdk Portable/Java 21 Openjdk/Java 21 Openjdk Portable/Java 25 Openjdk/Java 25 Openjdk Portable/Hi/Openjdk/Java Openjdk Portable.Portable.Jdk.El.X86 64.Tar.Xz/Java 11 Openjdk.Portable.Jdk.El.X86 64.Tar.Xz/Java 11 Openjdk.Win.Jdk.X86 64.Zip/Java Openjdk.Win.Jdk.X86 64.Zip/Java 21 Openjdk.Win.Jdk.X86 64.Zip/Java 17 Openjdk.Portable.Jdk.El.X86 64.Tar.Xz/Java 21 Openjdk.Portable.Jdk.X86 64.Tar.Xz/Java 17 Openjdk.Win.Jdk.X86 64.Zip/Java 25 Openjdk.Portable.Jdk.X86 64.Tar.Xz/Java 25 Openjdk.Win.Jdk.X86 64.Zip builds, which remove affected eMudhra-related root CA certificates from the Java trust store, closing all 2 injection vectors (man-in-the-middle TLS interception, forged certificate issuance using weak intermediate CA keys). Until patched, this is a concern on Java client applications, sandboxed Java Web Start applications, or applets running on Oracle Java SE, Oracle GraalVM, and OpenJDK builds on any platform, so Implement TLS certificate or public key pinning on client connections to prevent acceptance of certificates chained to weak eMudhra intermediate CAs. These controls limit blast radius and contain exploitation, but they do not fix the underlying weak intermediate CA key trust defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-404 Certificate Pinning (high)

🔗 References (45)