Red Hat Security Advisory: java-21-ibm-semeru-certified-jdk security update

Fixed packages 7

Vulnerabilities 12

• High 7.5
  CVE-2026-47063

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

  Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine
  Jul 21, 2026
• Medium 6.9
  CVE-2026-16441

  Eclipse OpenJ9 : Method resolution default method precedence failure

  In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method.

  Eclipse Foundation OpenJ9
  Jul 21, 2026
• Medium 6.5
  CVE-2026-60147

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

  Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine
  Jul 21, 2026
• Medium 5.9
  CVE-2026-46968

  Vulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u491, 8u49…

  Oracle Oracle Java SE openjdk-8 openjdk-lts Debian Ubuntu Alpine Wolfi
  Jul 21, 2026
• Medium 5.8
  CVE-2026-16439

  Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow

  In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow.

  Eclipse Foundation OpenJ9
  Jul 21, 2026
• Medium 5.7
  CVE-2026-16243

  Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero

  In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero.

  Eclipse Foundation Eclipse OMR
  Jul 21, 2026
• Medium 5.3
  CVE-2026-46917

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

  Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine
  Jul 21, 2026
• Medium 5.3
  CVE-2026-47021

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

  Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine Wolfi
  Jul 21, 2026
• Medium 5.3
  CVE-2026-47027

  Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491,…

  Oracle Oracle Java SE openjdk-8 openjdk-lts Debian Ubuntu Alpine
  Jul 21, 2026
• Medium 4.0
  CVE-2026-41254

  Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed…

  littlecms little cms color engine openjdk11 openjdk-17 Debian Ubuntu Azure Linux Alpine
  Apr 18, 2026
• Low 3.7
  CVE-2026-47010

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

  Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine Wolfi
  Jul 21, 2026
• Low 3.7
  CVE-2026-47059

  Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

  Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine
  Jul 21, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2459420
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502751
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502782
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502783
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502784
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502791
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502792
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2502793
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503636
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503798
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503988
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2503992
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52948.json
• report
  https://access.redhat.com/security/cve/CVE-2026-16243
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-16243
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-16243
• article
  https://github.com/eclipse-omr/omr/pull/8348
• article
  https://github.com/eclipse-omr/omr/pull/8349
• article
  https://gitlab.eclipse.org/security/cve-assignment/-/work_items/195
• report
  https://access.redhat.com/security/cve/CVE-2026-16439
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-16439
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-16439
• article
  https://github.com/eclipse-openj9/openj9/pull/24394
• article
  https://gitlab.eclipse.org/security/cve-assignment/-/work_items/192
• report
  https://access.redhat.com/security/cve/CVE-2026-16441
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-16441
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-16441
• article
  https://github.com/eclipse-openj9/openj9/pull/24396
• article
  https://github.com/eclipse-openj9/openj9/security/advisories/GHSA-hcfc-9hjx-2q7f
• article
  https://gitlab.eclipse.org/security/cve-assignment/-/work_items/194
• report
  https://access.redhat.com/security/cve/CVE-2026-41254
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-41254
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-41254
• article
  https://abhinavagarwal07.github.io/posts/lcms2-cubesize-overflow/
• article
  https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0
• article
  https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc
• article
  https://github.com/mm2/Little-CMS/security/advisories/GHSA-4xp6-rcgg-m9qq
• article
  https://www.openwall.com/lists/oss-security/2026/04/17/16