Red Hat has issued a security advisory (RHSA-2025:8063) for the java-21-ibm-semeru-certified-jdk package in Red Hat Enterprise Linux 10, addressing multiple vulnerabilities identified as CVE-2025-2900, CVE-2025-21587, and CVE-2025-30698. These flaws include issues categorized under CWE-122 (Heap-based Buffer Overflow) and CWE-208 (Information Exposure Through Error Message). The advisory provides updated package versions (21.0.7.0.6-1.el10_0) that fix these vulnerabilities. The update is available for various architectures including x86_64, s390x, ppc64le, and aarch64. No CVSS score is provided, but the advisory classifies the severity as moderate.

The vulnerabilities affect the IBM Semeru Runtime Certified Edition 21 runtime environment, potentially allowing attackers to exploit heap-based buffer overflow and information exposure flaws. The exact impact details are not specified in the advisory, but such issues can lead to application crashes, information leakage, or other security risks. No known exploits in the wild have been reported at this time.

An official patch is available from Red Hat as part of the java-21-ibm-semeru-certified-jdk update to version 21.0.7.0.6-1.el10_0. Users of Red Hat Enterprise Linux 10 should apply this update promptly following Red Hat's published guidance (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated by the vendor advisory.