The Red Hat Security Advisory RHSA-2026:9693 addresses multiple security vulnerabilities in the OpenJDK 25 packages for Red Hat Enterprise Linux 9 and 10. The update includes fixes for several CVEs affecting the JDK itself, such as CVE-2026-22007 (crypto algorithm support), CVE-2026-22013 (Kerberos credentialing), CVE-2026-22021 (certificate chain validation), and others related to TLS handling and key generation. It also updates third-party libraries like giflib and libpng, which have vulnerabilities including denial of service, information disclosure, and use-after-free leading to arbitrary code execution. A bug fix corrects the fallback behavior for file copying functions in OpenJDK 25. The advisory does not provide CVSS scores but rates the update as important. No known exploits in the wild are reported. The update is available for multiple architectures and variants of Red Hat Enterprise Linux 9 and 10 and their CodeReady Linux Builder counterparts.

The vulnerabilities addressed affect cryptographic operations, credential handling, certificate validation, and file processing within the OpenJDK 25 environment, potentially impacting the security and stability of Java applications running on affected Red Hat Enterprise Linux systems. Third-party library vulnerabilities could lead to denial of service, information disclosure, or arbitrary code execution if exploited. The overall impact is rated as important by Red Hat, indicating a high risk if unpatched.

Red Hat has released an updated java-25-openjdk package that addresses these vulnerabilities. Users should apply this update promptly to affected Red Hat Enterprise Linux 9 and 10 systems. Before applying this update, ensure all previously released errata relevant to your system have been applied. Detailed update instructions are available from Red Hat's official documentation. There are no indications that the vulnerabilities are already mitigated or that no action is required.