This security advisory from Red Hat addresses three vulnerabilities in the java-1.8.0-openjdk packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support. The vulnerabilities are identified as CVE-2026-21925 (improving JMX connections), CVE-2026-21933 (improving HttpServer request handling), and CVE-2026-21945 (enhancing certificate checking). These issues affect the OpenJDK 8 Java Runtime Environment and Software Development Kit. Red Hat has released updated packages to fix these vulnerabilities as part of their January 2026 security update. The advisory rates the update as important and recommends applying the update after ensuring all previous errata are applied.

The vulnerabilities impact the security of Java Management Extensions (JMX) connections, HTTP server request handling, and certificate validation within OpenJDK 8 on Red Hat Enterprise Linux 7 ELS. These issues could potentially allow attackers to exploit weaknesses in these components, affecting the integrity and security of Java applications running on the affected systems. The advisory does not report any known exploits in the wild at this time.

Red Hat has released updated java-1.8.0-openjdk packages that address these vulnerabilities. Users should apply the security update RHSA-2026:0931 for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Before applying this update, ensure all previously released errata relevant to the system have been applied. Detailed instructions for applying the update are available on Red Hat's official documentation. No additional mitigation steps are indicated by the vendor advisory.