This Red Hat security advisory (RHSA-2026:9254) covers multiple vulnerabilities in the java-1.8.0-openjdk and java-11-openjdk packages, including CVE-2025-66293 and 14 additional CVEs from 2026. The issues include out-of-bounds reads, heap buffer overflows, use-after-free vulnerabilities, information disclosure, denial of service, and weaknesses in cryptographic algorithm support and certificate chain validation. Affected components include LIBPNG, GIFLIB, Kerberos, and FreeType libraries integrated within the JDK. The advisory targets the OpenJDK 11 Extended Lifecycle Support packages for Red Hat Enterprise Linux versions 7, 8, and 9 across multiple architectures. The vendor recommends applying the update after ensuring all previous errata are applied. No explicit CVSS scores or detailed exploit information are provided, and no known exploits in the wild have been reported.

The vulnerabilities collectively could lead to information disclosure, denial of service, arbitrary code execution, and weakened cryptographic protections in affected OpenJDK 8 and 11 packages on Red Hat Enterprise Linux 7, 8, and 9. The presence of heap buffer overflows and use-after-free issues indicates potential for memory corruption and code execution. However, no known exploits in the wild have been reported, and the vendor has released an update to address these issues.

Red Hat has released an updated java-11-openjdk package with Extended Lifecycle Support that addresses these vulnerabilities. Users should apply this update after confirming that all previously released errata relevant to their system have been applied. Detailed update instructions are available from Red Hat's official documentation. Since this is an official security advisory with an available update, applying the vendor-provided patch is the primary mitigation.