Summary
The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit.
Security Fix(es):
* JDK: Enhance crypto algorithm support (CVE-2026-22007)
* JDK: Improved Arena allocations (CVE-2026-22008)
* JDK: Improve Kerberos credentialing (CVE-2026-22013)
* JDK: Enhance Path Factories Redux (CVE-2026-22016)
* JDK: Enhance Zip file reading (CVE-2026-22018)
* JDK: Enhance certificate chain validation (CVE-2026-22021)
* JDK: Updating FreeType 2.14.1 (CVE-2026-23865)
* JDK: Enhance TLS connection handling (CVE-2026-34282)
* JDK: Enhance key generation (CVE-2026-34268)
This release also updates a number of third-party libraries included in the JDK. The libraries themselves are affected by the following CVEs, but this is not a statement that the JDK itself is affected:
* giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740)
* libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)
* libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)
Bug Fix(es):
* When copying files, OpenJDK 25 prefers to use the copy_file_range native function for performance reasons, only falling back to sendfile when this fails. However, in previous OpenJDK 25 releases, a response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile. This is rectified in this release. (AlmaLinux-169939, AlmaLinux-169937)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 52
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | java-25-openjdk | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-crypto-adapter | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-crypto-adapter-fastdebug | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-crypto-adapter-slowdebug | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-demo | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-demo-fastdebug | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-demo-slowdebug | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-devel | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-devel-fastdebug | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-devel-slowdebug | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-fastdebug | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-headless | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-headless-fastdebug | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-headless-slowdebug | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-javadoc | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-javadoc-zip | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-jmods | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-jmods-fastdebug | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-jmods-slowdebug | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-slowdebug | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-src | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-src-fastdebug | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-src-slowdebug | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-static-libs | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-static-libs-fastdebug | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 10 | java-25-openjdk-static-libs-slowdebug | 1:25.0.3.0.9-1.el10_2 |
| AlmaLinux · 9 | java-25-openjdk | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-crypto-adapter | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-crypto-adapter-fastdebug | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-crypto-adapter-slowdebug | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-demo | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-demo-fastdebug | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-demo-slowdebug | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-devel | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-devel-fastdebug | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-devel-slowdebug | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-fastdebug | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-headless | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-headless-fastdebug | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-headless-slowdebug | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-javadoc | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-javadoc-zip | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-jmods | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-jmods-fastdebug | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-jmods-slowdebug | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-slowdebug | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-src | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-src-fastdebug | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-src-slowdebug | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-static-libs | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-static-libs-fastdebug | 1:25.0.3.0.9-1.el9.alma.1 |
| AlmaLinux · 9 | java-25-openjdk-static-libs-slowdebug | 1:25.0.3.0.9-1.el9.alma.1 |
Vulnerabilities 12
-
High 8.2
Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBTo…
-
High 7.6
LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palett…
-
High 7.5CVE-2026-22016 Public exploit
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
High 7.5
LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE` each alias a heap-allocated buffer between `png_str…
-
High 7.5
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 5.3CVE-2026-22013 Public exploit
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 5.3
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 5.3
An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.1…
-
Low 3.7CVE-2026-22008 Public exploit
Vulnerability in Oracle Java SE (component: Libraries). The supported version that is affected is Oracle Java SE: 25.0.…
-
Low 3.7CVE-2026-22018 Public exploit
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Low 2.9CVE-2026-22007 Public exploit
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Low 2.9
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
References
-
report
https://access.redhat.com/security/cve/CVE-2026-22007
-
report
https://access.redhat.com/security/cve/CVE-2026-22008
-
report
https://access.redhat.com/security/cve/CVE-2026-22013
-
report
https://access.redhat.com/security/cve/CVE-2026-22016
-
report
https://access.redhat.com/security/cve/CVE-2026-22018
-
report
https://access.redhat.com/security/cve/CVE-2026-22021
-
report
https://access.redhat.com/security/cve/CVE-2026-23865
-
report
https://access.redhat.com/security/cve/CVE-2026-26740
-
report
https://access.redhat.com/security/cve/CVE-2026-33416
-
report
https://access.redhat.com/security/cve/CVE-2026-33636
-
report
https://access.redhat.com/security/cve/CVE-2026-34268
-
report
https://access.redhat.com/security/cve/CVE-2026-34282
-
advisory
https://errata.almalinux.org/10/ALSA-2026-9693.html
-
advisory
https://errata.almalinux.org/9/ALSA-2026-9693.html