Aggregator

USN-8890-3: libsoup regression

Ubuntu Security Advisories
3 hours 51 minutes ago
USN-8890-1 fixed vulnerabilities in libsoup. Unfortunately, that update introduced a memory leak in the cookie jar and could introduce a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-4271) It was discovered that libsoup incorrectly handled certain HTTPS proxy connections. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-5119) It was discovered that libsoup incorrectly parsed certain chunked HTTP requests. A remote attacker could possibly use this issue to bypass security controls. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-6324) It was discovered that libsoup incorrectly handled proxy authentication credentials. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-66339) It was discovered that libsoup incorrectly handled certain HTTP Range headers. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-77014, CVE-2026-77680) It was discovered that libsoup incorrectly handled certain HTTP/2 connections. A remote attacker could possibly use this issue to obtain sensitive information or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85197) It was discovered that libsoup incorrectly handled certain HTTP/2 transfers. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-85534)

strongswan-6.1.0-2.fc43

Fedora Security Advisories
8 hours 40 minutes ago
FEDORA-2026-bf0e682c10 Packages in this update:
  • strongswan-6.1.0-2.fc43
Update description:

Update to 6.1.0 for CVE-2026-78123, CVE-2026-78124, CVE-2026-78126, CVE-2026-78127, CVE-2026-78129, CVE-2026-78130, CVE-2026-78131, CVE-2026-78132, CVE-2026-78133, CVE-2026-78134 and CVE-2026-78135

strongswan-6.1.0-1.fc44

Fedora Security Advisories
8 hours 41 minutes ago
FEDORA-2026-357d4a65d4 Packages in this update:
  • strongswan-6.1.0-1.fc44
Update description:

Update to 6.1.0 for CVE-2026-78123, CVE-2026-78124, CVE-2026-78126, CVE-2026-78127, CVE-2026-78129, CVE-2026-78130, CVE-2026-78131, CVE-2026-78132, CVE-2026-78133, CVE-2026-78134 and CVE-2026-78135

USN-9015-1: OpenJDK 21 vulnerabilities

Ubuntu Security Advisories
9 hours 3 minutes ago
It was discovered that the Security component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the JSSE component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83376) It was discovered that the Compiler component of OpenJDK 21 did not correctly authorize users. An unauthenticated remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-83378) It was discovered that the JAAS component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83380) It was discovered that the Security component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-83381) It was discovered that the JDBC component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83387) It was discovered that the Networking component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service or modify sensitive data. (CVE-2026-83395) It was discovered that the JAXP component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-83400) It was discovered that the JAXP component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-87290) It was discovered that the Networking component of OpenJDK 21 did not correctly authorize users. An unauthenticated remote attacker could possibly use this issue to read sensitive data. (CVE-2026-87291) It was discovered that the Networking component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87292) It was discovered that the Security component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-87294) It was discovered that the JAXP component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87367) It was discovered that the Networking component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91332) It was discovered that the Security component of OpenJDK 21 did not correctly authorize users. An unauthenticated remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91333) It was discovered that the ImageIO component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91334) It was discovered that the AWT component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91335) It was discovered that the JSSE component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91373) It was discovered that the Serviceability component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91374) It was discovered that the Libraries component of OpenJDK 21 did not correctly authenticate users. A local attacker could possibly use this issue to modify sensitive data. (CVE-2026-91375) It was discovered that the JDK tools component of OpenJDK 21 did not correctly authenticate users. A local attacker could possibly use this issue to modify sensitive data. (CVE-2026-91379) It was discovered that the Utility component of OpenJDK 21 did not correctly authorize users. A local attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91380) It was discovered that the Networking component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91394) It was discovered that the Serviceability component of OpenJDK 21 did not correctly authorize users. A local attacker could possibly use this issue to cause a denial of service or modify sensitive data. (CVE-2026-91397) It was discovered that the Networking component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91398) It was discovered that the Sound component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91400) It was discovered that the JSSE component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91403) It was discovered that the Libraries component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91410) It was discovered that the 2D component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or read or modify sensitive data. (CVE-2026-91415) It was discovered that the ImageIO component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91418) It was discovered that the Networking component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91451, CVE-2026-91452) It was discovered that the Lightweight HTTP Server component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91453) It was discovered that the JSSE component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91461) It was discovered that the JGSS component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91462) It was discovered that the JGSS component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91463, CVE-2026-91464) It was discovered that the Compiler component of OpenJDK 21 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91487) It was discovered that the Libraries component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-101516) It was discovered that the Security component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-114820) In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2026-10-20 https://openjdk.org/groups/vulnerability/advisories/2026-10-21 https://openjdk.org/groups/vulnerability/advisories/2026-10-24

USN-9014-1: OpenJDK 17 vulnerabilities

Ubuntu Security Advisories
9 hours 36 minutes ago
It was discovered that the Security component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the JSSE component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83376) It was discovered that the JAAS component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83380) It was discovered that the Security component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-83381) It was discovered that the JDBC component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83387) It was discovered that the Networking component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service or modify sensitive data. (CVE-2026-83395) It was discovered that the JAXP component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-83400) It was discovered that the JAXP component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-87290) It was discovered that the Networking component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87292) It was discovered that the Security component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-87294) It was discovered that the JAXP component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87367) It was discovered that the Networking component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91332) It was discovered that the ImageIO component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91334) It was discovered that the AWT component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91335) It was discovered that the JSSE component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91373) It was discovered that the Serviceability component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91374) It was discovered that the Libraries component of OpenJDK 17 did not correctly authenticate users. A local attacker could possibly use this issue to modify sensitive data. (CVE-2026-91375) It was discovered that the JDK tools component of OpenJDK 17 did not correctly authenticate users. A local attacker could possibly use this issue to modify sensitive data. (CVE-2026-91379) It was discovered that the Utility component of OpenJDK 17 did not correctly authorize users. A local attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91380) It was discovered that the 2D component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or modify sensitive data. (CVE-2026-91382) It was discovered that the Networking component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91394) It was discovered that the Serviceability component of OpenJDK 17 did not correctly authorize users. A local attacker could possibly use this issue to cause a denial of service or modify sensitive data. (CVE-2026-91397) It was discovered that the Networking component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91398) It was discovered that the Sound component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91400) It was discovered that the JSSE component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91403) It was discovered that the Libraries component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91410) It was discovered that the 2D component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or read or modify sensitive data. (CVE-2026-91415) It was discovered that the ImageIO component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91418) It was discovered that the Networking component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91451, CVE-2026-91452) It was discovered that the Lightweight HTTP Server component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91453) It was discovered that the JSSE component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91461) It was discovered that the JGSS component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91462) It was discovered that the JGSS component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91463, CVE-2026-91464) It was discovered that the Compiler component of OpenJDK 17 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91487) It was discovered that the Libraries component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-101516) It was discovered that the Security component of OpenJDK 17 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-114820) In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2026-10-20 https://openjdk.org/groups/vulnerability/advisories/2026-10-21 https://openjdk.org/groups/vulnerability/advisories/2026-10-24

USN-9013-1: Fetchmail vulnerabilities

Ubuntu Security Advisories
9 hours 46 minutes ago
Christian Herdtweck discovered that Fetchmail incorrectly handled certain long log messages. A remote attacker could possibly use this issue to cause Fetchmail to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-36386) It was discovered that the Fetchmail SMTP client incorrectly handled certain status code messages. An attacker controlling a malicious server could possibly use this issue to cause Fetchmail to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2025-61962) Tristan Madani discovered that Fetchmail incorrectly handled certain NTLM authentication challenges. A remote attacker could possibly use this issue to cause Fetchmail to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service. (CVE-2026-94184)

USN-9012-1: libheif vulnerability

Ubuntu Security Advisories
10 hours 19 minutes ago
Alex Thomas discovered that libheif incorrectly handled certain HEIF images. An attacker could possibly use this issue to execute arbitrary code if a user or automated system were tricked into opening a specially crafted file.

USN-9011-1: pyasn1 vulnerabilities

Ubuntu Security Advisories
10 hours 48 minutes ago
It was discovered that pyasn1 did not properly bound the size of long-form tag identifiers when parsing BER, CER, or DER encoded data. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-59884) It was discovered that pyasn1 processed OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-59885) It was discovered that pyasn1 incorrectly handled conversion of decoded REAL values to Python float types. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU and memory resources, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-59886) It was discovered that pyasn1 incorrectly handled tracking component types when decoding containers without a schema. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. (CVE-2026-119194) It was discovered that pyasn1 processed fragmented constructed strings and indefinite-length ANY values in quadratic time. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. This issue was only addressed in Ubuntu 26.04 LTS and Ubuntu 26.10. (CVE-2026-119195) It was discovered that pyasn1 processed fragmented constructed BIT STRING values in quadratic time. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. (CVE-2026-119196) It was discovered that pyasn1 processed binary-encoded REAL values with large mantissas in quadratic time. An attacker could possibly use this issue to cause applications decoding untrusted ASN.1 data to consume excessive CPU resources, resulting in a denial of service. (CVE-2026-119197)

USN-9009-1: OpenJDK 8 vulnerabilities

Ubuntu Security Advisories
10 hours 59 minutes ago
It was discovered that the Security component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the JSSE component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83376, CVE-2026-91461) It was discovered that the JAAS component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83380) It was discovered that the Security component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-83381, CVE-2026-87294) It was discovered that the JDBC component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83387) It was discovered that the Networking component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-83395) It was discovered that the JAXP component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-83400) It was discovered that the JAXP component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-87290) It was discovered that the Networking component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87292, CVE-2026-91451, CVE-2026-91452) It was discovered that the RMI component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-87293) It was discovered that the JAXP component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87367) It was discovered that the ImageIO component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91334) It was discovered that the AWT component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91335) It was discovered that the JSSE component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91373) It was discovered that the Serviceability component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91374) It was discovered that the Utility component of OpenJDK 8 did not correctly authorize users. A local attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91380) It was discovered that the 2D component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91381) It was discovered that the 2D component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91382) It was discovered that the Utility component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91395, CVE-2026-91396) It was discovered that the Serviceability component of OpenJDK 8 did not correctly authorize users. A local attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91397) It was discovered that the Networking component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91398) It was discovered that the Sound component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91400) It was discovered that the JSSE component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91403) It was discovered that the Libraries component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91410) It was discovered that the JGSS component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91411) It was discovered that the 2D component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to read or modify sensitive data. (CVE-2026-91415) It was discovered that the CORBA component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91417) It was discovered that the ImageIO component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91418) It was discovered that the Lightweight HTTP Server component of OpenJDK 8 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91453) It was discovered that the JGSS component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91462) It was discovered that the JGSS component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91463, CVE-2026-91464) It was discovered that the Security component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-114820) In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2026-10-20 https://openjdk.org/groups/vulnerability/advisories/2026-10-21 https://openjdk.org/groups/vulnerability/advisories/2026-10-24

USN-9010-1: OpenJDK 11 vulnerabilities

Ubuntu Security Advisories
11 hours 28 minutes ago
It was discovered that the Security component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the JSSE component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83376, CVE-2026-91461) It was discovered that the JAAS component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83380) It was discovered that the Security component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-83381, CVE-2026-87294) It was discovered that the JDBC component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-83387) It was discovered that the Networking component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-83395) It was discovered that the JAXP component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-83400) It was discovered that the JAXP component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-87290) It was discovered that the Networking component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87292, CVE-2026-91332, CVE-2026-91451, CVE-2026-91452) It was discovered that the JAXP component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-87367) It was discovered that the ImageIO component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91334) It was discovered that the AWT component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91335) It was discovered that the JSSE component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91373) It was discovered that the Serviceability component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91374) It was discovered that the Libraries component of OpenJDK 11 did not correctly authenticate users. A local attacker could possibly use this issue to modify sensitive data. (CVE-2026-91375) It was discovered that the JDK tools component of OpenJDK 11 did not correctly authenticate users. A local attacker could possibly use this issue to modify sensitive data. (CVE-2026-91379) It was discovered that the Utility component of OpenJDK 11 did not correctly authorize users. A local attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91380) It was discovered that the 2D component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91382) It was discovered that the Networking component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91394) It was discovered that the Utility component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91395, CVE-2026-91396) It was discovered that the Serviceability component of OpenJDK 11 did not correctly authorize users. A local attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91397) It was discovered that the Networking component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91398) It was discovered that the Sound component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91400) It was discovered that the JSSE component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91403) It was discovered that the Libraries component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91410) It was discovered that the JGSS component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to modify sensitive data. (CVE-2026-91411) It was discovered that the 2D component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to read or modify sensitive data. (CVE-2026-91415) It was discovered that the ImageIO component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-91418) It was discovered that the Lightweight HTTP Server component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91453) It was discovered that the JGSS component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-91462) It was discovered that the JGSS component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read sensitive data. (CVE-2026-91463, CVE-2026-91464) It was discovered that the Compiler component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-91487) It was discovered that the Security component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-114820) In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes. Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2026-10-20 https://openjdk.org/groups/vulnerability/advisories/2026-10-21 https://openjdk.org/groups/vulnerability/advisories/2026-10-24