Red Hat Security Advisory: java-11-openjdk ELS security update

Fixed packages 85

Vulnerabilities 5

• High 7.5
  CVE-2026-21945

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

  Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine Wolfi
  Jan 20, 2026
• High 7.1
  CVE-2025-64720 Public exploit

  LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication

  LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when proces…

  pnggroup libpng openjpeg2 fltk Debian Ubuntu Azure Linux Alpine Wolfi
  Nov 24, 2025
• High 7.1
  CVE-2025-65018 Public exploit

  LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`

  LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API functio…

  pnggroup libpng openjpeg2 fltk Debian Ubuntu Azure Linux Alpine Wolfi
  Nov 24, 2025
• Medium 6.1
  CVE-2026-21933

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

  Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine Wolfi
  Jan 20, 2026
• Medium 4.8
  CVE-2026-21925

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

  Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine Wolfi
  Jan 20, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0847.json
• report
  https://access.redhat.com/security/cve/CVE-2025-64720
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2416904
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-64720
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-64720
• article
  https://github.com/pnggroup/libpng/commit/08da33b4c88cfcd36e5a706558a8d7e0e4773643
• article
  https://github.com/pnggroup/libpng/issues/686
• article
  https://github.com/pnggroup/libpng/pull/751
• article
  https://github.com/pnggroup/libpng/security/advisories/GHSA-hfc7-ph9c-wcww
• report
  https://access.redhat.com/security/cve/CVE-2025-65018
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2416907
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-65018
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-65018
• article
  https://github.com/pnggroup/libpng/commit/16b5e3823918840aae65c0a6da57c78a5a496a4d
• article
  https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea
• article
  https://github.com/pnggroup/libpng/issues/755
• article
  https://github.com/pnggroup/libpng/pull/757
• article
  https://github.com/pnggroup/libpng/security/advisories/GHSA-7wv6-48j4-hj3g
• report
  https://access.redhat.com/security/cve/CVE-2026-21925
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2429924
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-21925
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-21925
• article
  https://www.oracle.com/security-alerts/cpujan2026.html#AppendixJAVA
• report
  https://access.redhat.com/security/cve/CVE-2026-21933
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2429926
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-21933
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-21933
• report
  https://access.redhat.com/security/cve/CVE-2026-21945
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2429927
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-21945
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-21945