Red Hat Security Advisory: java-21-openjdk security update
The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Better Glyph drawing (CVE-2025-30749) * JDK: Enhance TLS protocol support (CVE-2025-30754) * JDK: Improve HTTP client header handling (CVE-2025-50059) * JDK: Better Glyph drawing redux (CVE-2025-50106) Bug Fix(es): * In Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 systems, the default graphical display system is Wayland. The use of Wayland in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a screen capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire package, which the JDK can use to take screen captures in Wayland systems (RHEL-102683, RHEL-102684, RHEL-102685) * On NUMA systems, the operating system can choose to migrate a task from one NUMA node to another. In the G1 garbage collector, G1AllocRegion objects are associated with NUMA nodes. The G1Allocator code assumes that obtaining the G1AllocRegion object for the current thread is sufficient, but OS scheduling can lead to arbitrary changes in the NUMA-to-thread association. This can cause crashes when the G1AllocRegion being used changes mid-operation. This update resolves this issue by always using the same NUMA node and associated G1AllocRegion object throughout an operation. (RHEL-90307, RHEL-90308, RHEL-90311) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
Red Hat issued a security advisory (RHSA-2025:10873) for the java-21-openjdk package addressing four security vulnerabilities: CVE-2025-30749 and CVE-2025-50106 (glyph drawing improvements), CVE-2025-30754 (TLS protocol enhancement), and CVE-2025-50059 (HTTP client header handling improvement). The advisory also fixes bugs related to screen capture on Wayland systems by recommending the PipeWire package and resolves crashes in the G1 garbage collector on NUMA systems by ensuring consistent NUMA node usage during operations. The update applies to multiple Red Hat Enterprise Linux 8, 9, and 10 variants and associated CodeReady Linux Builder products. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat Product Security.
Potential Impact
The vulnerabilities affect the OpenJDK 21 Java Runtime Environment and SDK, potentially impacting graphical rendering (glyph drawing), TLS protocol security, and HTTP client header processing. The bugs fixed improve compatibility with Wayland graphical systems and stability of the G1 garbage collector on NUMA architectures, preventing crashes. The overall security impact is rated as Important (high severity) by Red Hat. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
An official security update for java-21-openjdk is available from Red Hat for affected Red Hat Enterprise Linux 8, 9, and 10 systems, including Extended Update Support and CodeReady Linux Builder variants. Users should apply the update as per Red Hat's guidance at https://access.redhat.com/articles/11258. The update also recommends installing the PipeWire package on Wayland systems to restore screen capture functionality. Since this is an official fix, applying the update fully mitigates the described vulnerabilities and bugs.
Red Hat Security Advisory: java-21-openjdk security update
Description
The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Better Glyph drawing (CVE-2025-30749) * JDK: Enhance TLS protocol support (CVE-2025-30754) * JDK: Improve HTTP client header handling (CVE-2025-50059) * JDK: Better Glyph drawing redux (CVE-2025-50106) Bug Fix(es): * In Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 systems, the default graphical display system is Wayland. The use of Wayland in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a screen capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire package, which the JDK can use to take screen captures in Wayland systems (RHEL-102683, RHEL-102684, RHEL-102685) * On NUMA systems, the operating system can choose to migrate a task from one NUMA node to another. In the G1 garbage collector, G1AllocRegion objects are associated with NUMA nodes. The G1Allocator code assumes that obtaining the G1AllocRegion object for the current thread is sufficient, but OS scheduling can lead to arbitrary changes in the NUMA-to-thread association. This can cause crashes when the G1AllocRegion being used changes mid-operation. This update resolves this issue by always using the same NUMA node and associated G1AllocRegion object throughout an operation. (RHEL-90307, RHEL-90308, RHEL-90311) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat issued a security advisory (RHSA-2025:10873) for the java-21-openjdk package addressing four security vulnerabilities: CVE-2025-30749 and CVE-2025-50106 (glyph drawing improvements), CVE-2025-30754 (TLS protocol enhancement), and CVE-2025-50059 (HTTP client header handling improvement). The advisory also fixes bugs related to screen capture on Wayland systems by recommending the PipeWire package and resolves crashes in the G1 garbage collector on NUMA systems by ensuring consistent NUMA node usage during operations. The update applies to multiple Red Hat Enterprise Linux 8, 9, and 10 variants and associated CodeReady Linux Builder products. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat Product Security.
Potential Impact
The vulnerabilities affect the OpenJDK 21 Java Runtime Environment and SDK, potentially impacting graphical rendering (glyph drawing), TLS protocol security, and HTTP client header processing. The bugs fixed improve compatibility with Wayland graphical systems and stability of the G1 garbage collector on NUMA architectures, preventing crashes. The overall security impact is rated as Important (high severity) by Red Hat. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
An official security update for java-21-openjdk is available from Red Hat for affected Red Hat Enterprise Linux 8, 9, and 10 systems, including Extended Update Support and CodeReady Linux Builder variants. Users should apply the update as per Red Hat's guidance at https://access.redhat.com/articles/11258. The update also recommends installing the PipeWire package on Wayland systems to restore screen capture functionality. Since this is an official fix, applying the update fully mitigates the described vulnerabilities and bugs.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:10873
- Cve Count
- 4
- Additional Cves
- ["CVE-2025-30754","CVE-2025-50059","CVE-2025-50106"]
Threat ID: 6a1f4e87e29bf47b500805e4
Added to database: 06/02/2026, 21:43:35 UTC
Last enriched: 06/26/2026, 02:00:20 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 72
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.