The Red Hat Security Advisory RHSA-2026:42895 provides security updates for OpenJDK 21 packages distributed with Red Hat Enterprise Linux versions 8, 9, and 10, including Extended Update Support releases. It addresses nine CVEs related to improvements in TLS and DTLS protocols, image format handling (JPEG, XBM), Jar file processing, certification verification, and the AWT ImagingLib. The update also includes an upgrade of the LCMS library to version 2.19 (CVE-2026-41254). The advisory clarifies version numbering for builds and fixes RPM packaging issues related to documentation directories. The update is classified as important and applies to multiple Red Hat Enterprise Linux variants and architectures.

The vulnerabilities fixed in this update affect the security and robustness of the Java runtime environment, including cryptographic certificate handling, secure communication protocols (TLS/DTLS), image processing libraries, and Jar file handling. These issues could potentially lead to security weaknesses such as improper certificate validation, denial of service, or other impacts related to malformed image or Jar files. The update improves the security posture of OpenJDK 21 by addressing these issues. No known exploits in the wild have been reported at this time.

A security update for the java-21-openjdk package is available from Red Hat. Users should apply this update to affected Red Hat Enterprise Linux systems as soon as possible. Before applying this update, ensure all previously released relevant errata have been applied. Detailed instructions for applying the update are available in the Red Hat advisory at https://access.redhat.com/articles/11258. This update includes official fixes for all listed vulnerabilities.