This Red Hat security advisory covers multiple vulnerabilities in the OpenJDK 11 Extended Lifecycle Support packages for portable Linux. The update to version 11.0.31 fixes several security issues including: out-of-bounds read in png_image_read_composite (CVE-2025-66293), information disclosure and denial of service via integer truncation in the simplified write API (CVE-2026-22801), heap buffer overflow in png_set_quantize (CVE-2026-25646), denial of service via buffer overflow in GIFLIB's EGifGCBToExtension (CVE-2026-26740), arbitrary code execution due to use-after-free in LIBPNG (CVE-2026-33416), and other information disclosure and denial of service vulnerabilities in LIBPNG. Additional CVEs without detailed descriptions are also addressed. The update replaces OpenJDK 11.0.30 and is applicable to Red Hat builds of OpenJDK 11 with Extended Lifecycle Support on multiple architectures. The vendor advisory confirms the availability of an official patch and recommends applying this update after ensuring all prior errata are applied.

The vulnerabilities fixed in this update include memory corruption issues such as out-of-bounds reads, heap buffer overflows, and use-after-free conditions that can lead to denial of service, information disclosure, and arbitrary code execution. These issues affect the OpenJDK 11 runtime and development kit, potentially impacting applications that use these libraries for image processing (LIBPNG, GIFLIB). Successful exploitation could allow attackers to disrupt service, leak sensitive information, or execute arbitrary code within the context of the Java runtime environment.

An official security update is available in Red Hat build of OpenJDK 11 version 11.0.31 ELS. Users should apply this update to remediate the vulnerabilities. Before applying this update, ensure all previously released errata relevant to your system have been applied. Follow Red Hat's documented procedures for updating OpenJDK packages. No additional mitigations are specified by the vendor advisory.