The java-1.8.0-openjdk packages contain multiple security vulnerabilities that have been addressed in the August 2026 Critical Security Patch Update by Oracle. The vulnerabilities include CVE-2026-60589, which improves resource resolving, CVE-2026-61308, which enhances HTTP connections, and CVE-2026-70907, which enhances the TLS server. These issues affect versions of OpenJDK 8 and related Red Hat Enterprise Linux packages prior to and including version 11.0.32.10.1, among others. The vendor advisory emphasizes the importance of applying these patches promptly to mitigate potential exploitation risks.

The vulnerabilities impact the security of Java runtime and development environments by addressing resource resolving, HTTP connection handling, and TLS server functionality. While the exact exploitation impact is not detailed, these areas are critical for secure application operation. No known exploits in the wild have been reported. The severity is assessed as medium based on the advisory.

A security update is available from Red Hat and Oracle as part of the August 2026 Critical Security Patch Update. Users should apply the official patches promptly to affected versions to mitigate these vulnerabilities. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are indicated beyond applying the official fixes.