Skip to content
OpenAdvisories
High · 7.5 CVE-2026-70906 EUVD-2026-61855GHSA-969j-f8m5-xpgq

Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploit…

Published Aug 18, 2026 · Updated Aug 22, 2026 · Assigned by oracle

Vendor: Oracle Product: Oracle Java SE Package: openjdk-13 Package: openjdk-16 Package: openjdk-18 Package: openjdk-25 Package: openjdk-25 Package: openjdk-9 Ecosystem: Debian Ecosystem: Ubuntu

Description

Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Affected products

VendorProductAffectedFixed
Oracle Oracle Java SE 25.0.4, 26.0.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 openjdk-25 25.0.4.1+1-1 —
Debian 13 openjdk-25 25.0.4.1+1-1~deb13u1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS openjdk-25 25.0.4.1+1-1~26.04.4 USN-8783-1
Ubuntu 24.04 LTS openjdk-25 25.0.4.1+1-1~24.04.4 USN-8783-1
Ubuntu 22.04 LTS openjdk-18 No fix yet —
Ubuntu 22.04 LTS openjdk-25 25.0.4.1+1-1~22.04.4 USN-8783-1
Ubuntu 20.04 LTS openjdk-13 +1 No fix yet —
Ubuntu 16.04 LTS openjdk-9 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 java-25-openjdk +25 1:25.0.4.1.1-1.1.el10 RHSA-2026:55798
RHEL 9 java-25-openjdk +25 1:25.0.4.1.1-1.1.el9 RHSA-2026:55798
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 java-25-openjdk +25 25.0.4.1.1-1.1.hum1 RHSA-2026:57765
Red Hat Hardened Images 1 java-25-openjdk-portable +11 25.0.4.1.1-0.1.hum1 RHSA-2026:57177

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 java-25-openjdk +25 1:25.0.4.1.1-1.1.el10.alma.1 ALSA-2026:55798
AlmaLinux 9 java-25-openjdk +25 1:25.0.4.1.1-1.1.el9.alma.1 ALSA-2026:55798

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 java-25-openjdk 1:25.0.4.1.1-1.1.el10_2 RLSA-2026:55798

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 java-1_8_0-ibm 1.8.0_sr8.71-150000.3.125.1 SUSE-SU-2026:4153-1
SLES 15 SP7 java-25-openjdk 25.0.4.1-150700.15.16.1 SUSE-SU-2026:3999-1
SLES 15 SP6 java-1_8_0-ibm 1.8.0_sr8.71-150000.3.125.1 SUSE-SU-2026:4153-1
SLES 15 SP5 java-1_8_0-ibm 1.8.0_sr8.71-150000.3.125.1 SUSE-SU-2026:4153-1
SLES 15 SP4 java-1_8_0-ibm 1.8.0_sr8.71-150000.3.125.1 SUSE-SU-2026:4153-1
SLES 12 SP5 java-1_8_0-ibm 1.8.0_sr8.71-30.156.1 SUSE-SU-2026:4107-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 java-25-openjdk 25.0.4.1-160000.1.1 SUSE-SU-2026:23591-1
SLES for SAP 15 SP6 java-1_8_0-ibm 1.8.0_sr8.71-150000.3.125.1 SUSE-SU-2026:4153-1
SLES for SAP 15 SP5 java-1_8_0-ibm 1.8.0_sr8.71-150000.3.125.1 SUSE-SU-2026:4153-1
SLES for SAP 15 SP4 java-1_8_0-ibm 1.8.0_sr8.71-150000.3.125.1 SUSE-SU-2026:4153-1
SLES 16.0 java-25-openjdk 25.0.4.1-160000.1.1 SUSE-SU-2026:23591-1
SLE HPC 15 SP4 java-1_8_0-ibm 1.8.0_sr8.71-150000.3.125.1 SUSE-SU-2026:4153-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed java-11-openj9 11.0.32.1-1.1 openSUSE-SU-2026:11639-1
openSUSE Tumbleweed java-17-openj9 17.0.20.1-1.1 openSUSE-SU-2026:11640-1
openSUSE Tumbleweed java-1_8_0-openj9 1.8.0.504-1.1 openSUSE-SU-2026:11641-1
openSUSE Tumbleweed java-21-openj9 21.0.12.1-1.1 openSUSE-SU-2026:11642-1
openSUSE Tumbleweed java-25-openj9 +1 25.0.4.1-1.1 openSUSE-SU-2026:11643-1, openSUSE-SU-2026:11621-1
openSUSE Leap 16.0 java-25-openjdk 25.0.4.1-160000.1.1 openSUSE-SU-2026:21714-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 java-25-amazon-corretto +5 1:25.0.4+8-1.amzn2023.1 ALAS2023-2026-2102
Amazon Linux 2023 java-26-amazon-corretto +5 1:26.0.2+11-1.amzn2023.1 ALAS2023-2026-2101

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 java-25-openjdk +25 1:25.0.4.1.1-1.1.0.1.el10 ELSA-2026-55798

Advisories 25

References