The advisory covers a set of 12 security fixes for the IBM Semeru Runtime Certified Edition 21 runtime environment, including: an integer overflow in Little CMS leading to information disclosure or denial of service (CVE-2026-41254); enhancements and improvements in OpenJDK related to TLS certificate handling (CVE-2026-46968), DTLS handshaking (CVE-2026-46917), JPEG and XBM image processing (CVE-2026-47010, CVE-2026-47021), Jar file processing and handling (CVE-2026-47027, CVE-2026-47063), AWT ImagingLib (CVE-2026-47059), and certification checking (CVE-2026-60147); Eclipse OpenJ9 buffer underflow via tracing method arguments (CVE-2026-16439); denial of service via improper input validation in Eclipse OMR arraycmp SIMD (CVE-2026-16243); and incorrect method delegation in Eclipse OpenJ9 leading to integrity issues (CVE-2026-16441). The advisory references Red Hat Enterprise Linux 10 and Extended Update Support versions for multiple architectures as affected products. Detailed CVSS scores and impact information are available on the respective CVE pages. The update is available via Red Hat's official channels.

The vulnerabilities collectively impact confidentiality, integrity, and availability of the IBM Semeru Runtime Certified Edition 21 environment. They include potential information disclosure, denial of service conditions, and integrity issues in method delegation. The severity is rated as important by Red Hat, indicating a high security impact but not critical. No known exploits in the wild have been reported at this time.

Red Hat has released updated packages for java-21-ibm-semeru-certified-jdk addressing these vulnerabilities. Users should apply the security update available for Red Hat Enterprise Linux 10 and its Extended Update Support versions as detailed in the advisory RHSA-2026:52948. Instructions and update packages are available at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official update.