Red Hat issued a security advisory (RHSA-2024:1822) addressing five vulnerabilities in the java-11-openjdk packages for OpenJDK 11. The fixed issues include CVE-2024-21011 (long exception message causing crash), CVE-2024-21068 (integer overflow in C1 compiler address generation), CVE-2024-21085 (Pack200 excessive memory allocation), CVE-2024-21094 (C2 compilation failure due to exceeded _node_regs array), and CVE-2024-21012 (HTTP/2 client improper reverse DNS lookup). These vulnerabilities affect multiple Red Hat Enterprise Linux 8 and 9 variants and architectures (x86_64, s390x, ppc64le, aarch64). The advisory does not provide CVSS scores but classifies the impact as Moderate. The update requires restarting all OpenJDK Java instances to apply the fixes.

The vulnerabilities could lead to application crashes, memory allocation issues, compiler failures, and improper network behavior in the HTTP/2 client. These issues may affect the stability and security of Java applications running on affected Red Hat Enterprise Linux systems. The overall security impact is rated Moderate by Red Hat Product Security. No known exploits in the wild have been reported at this time.

Red Hat has released an official security update for java-11-openjdk addressing these vulnerabilities. Users should apply the update as provided by Red Hat for their specific Red Hat Enterprise Linux version and architecture. After applying the update, all running OpenJDK Java instances must be restarted for the fixes to take effect. Refer to the Red Hat advisory RHSA-2024:1822 and https://access.redhat.com/articles/11258 for detailed update instructions.