Red Hat Security Advisory: Java 11 OpenJDK ELS Security Update

Fixed packages 85

Vulnerabilities 11

• High 7.5
  CVE-2026-47057

  Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491,…

  Oracle Oracle Java SE openjdk-8 openjdk-lts Debian Ubuntu Alpine
  Jul 21, 2026
• High 7.5
  CVE-2026-47063

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

  Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine
  Jul 21, 2026
• High 7.4
  CVE-2026-47058

  Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491,…

  Oracle Oracle Java SE openjdk-8 openjdk-lts Debian Ubuntu Alpine
  Jul 21, 2026
• Medium 6.5
  CVE-2026-60147

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

  Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine
  Jul 21, 2026
• Medium 5.9
  CVE-2026-46968

  Vulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u491, 8u49…

  Oracle Oracle Java SE openjdk-8 openjdk-lts Debian Ubuntu Alpine Wolfi
  Jul 21, 2026
• Medium 5.3
  CVE-2026-46917

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

  Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine
  Jul 21, 2026
• Medium 5.3
  CVE-2026-47021

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

  Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine Wolfi
  Jul 21, 2026
• Medium 5.3
  CVE-2026-47027

  Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491,…

  Oracle Oracle Java SE openjdk-8 openjdk-lts Debian Ubuntu Alpine
  Jul 21, 2026
• Medium 4.0
  CVE-2026-41254

  Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed…

  littlecms little cms color engine openjdk11 openjdk-17 Debian Ubuntu Azure Linux Alpine
  Apr 18, 2026
• Low 3.7
  CVE-2026-47010

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

  Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine Wolfi
  Jul 21, 2026
• Low 3.7
  CVE-2026-47059

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

  Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine
  Jul 21, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2459420
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502751
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502782
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502783
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502784
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502791
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502792
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502793
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502794
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502795
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503636
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42880.json
• report
  https://access.redhat.com/security/cve/CVE-2026-41254
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-41254
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-41254
• article
  https://abhinavagarwal07.github.io/posts/lcms2-cubesize-overflow/
• article
  https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0
• article
  https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc
• article
  https://github.com/mm2/Little-CMS/security/advisories/GHSA-4xp6-rcgg-m9qq
• article
  https://www.openwall.com/lists/oss-security/2026/04/17/16
• report
  https://access.redhat.com/security/cve/CVE-2026-46917
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46917
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46917
• report
  https://access.redhat.com/security/cve/CVE-2026-46968
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-46968
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-46968
• report
  https://access.redhat.com/security/cve/CVE-2026-47010
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-47010
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-47010
• report
  https://access.redhat.com/security/cve/CVE-2026-47021
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-47021
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-47021
• report
  https://access.redhat.com/security/cve/CVE-2026-47027
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-47027
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-47027
• report
  https://access.redhat.com/security/cve/CVE-2026-47057
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-47057
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-47057