Red Hat has released a security update for the java-21-ibm-semeru-certified-jdk package addressing several vulnerabilities identified in the IBM Semeru Runtime Certified Edition 21 runtime environment. The update fixes an information disclosure and denial of service vulnerability in freetype (CVE-2026-23865), multiple OpenJDK issues related to cryptographic algorithm support, path factories, Kerberos credentialing, certificate chain validation, key generation, and TLS connection handling (CVE-2026-22007, CVE-2026-22013, CVE-2026-22016, CVE-2026-22021, CVE-2026-34268, CVE-2026-34282), and a denial of service vulnerability in Eclipse Open9J JITServer via crafted TCP messages (CVE-2026-6918). These fixes correspond to Oracle CPU 2026-04 updates and Red Hat Bugzilla entries. The advisory covers Red Hat Enterprise Linux 10 and its Extended Update Support versions across multiple hardware architectures. Updated packages are available from Red Hat to address these vulnerabilities.

The vulnerabilities collectively could allow an attacker to cause denial of service conditions or information disclosure through specially crafted inputs such as font files or network messages. Cryptographic enhancements address potential weaknesses in algorithm support, certificate validation, Kerberos credentialing, key generation, and TLS handling, which could otherwise impact the security of cryptographic operations. The denial of service in Eclipse Open9J JITServer could disrupt Java runtime services via crafted TCP messages. No known exploits in the wild have been reported at this time.

Red Hat has released updated packages for the java-21-ibm-semeru-certified-jdk that address all listed vulnerabilities. Users of affected Red Hat Enterprise Linux 10 and Extended Update Support versions should apply these updates promptly following Red Hat's official guidance at https://access.redhat.com/articles/11258. No additional mitigations are indicated beyond applying the vendor-provided patches.