Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
This update includes the following RPMs: java-25-openjdk: * java-25-openjdk-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-crypto-adapter-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-crypto-adapter-fastdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-crypto-adapter-slowdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-demo-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-demo-fastdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-demo-slowdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-devel-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-devel-fastdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-devel-slowdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-fastdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-headless-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-headless-fastdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-headless-slowdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-javadoc-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-javadoc-zip-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-jmods-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-jmods-fastdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-jmods-slowdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-slowdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-src-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-src-fastdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-src-slowdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-static-libs-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-static-libs-fastdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-static-libs-slowdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-25.0.3.0.9-1.hum1.src (src)
AI Analysis
Technical Summary
CVE-2026-22007 is a vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition related to the use of broken or risky cryptographic algorithms (CWE-327). This vulnerability allows an unauthenticated attacker with local access to the infrastructure where these Java components execute to potentially gain unauthorized read access to some data. The vulnerability affects multiple Oracle Java SE versions including 8u481, 11.0.30, 17.0.18, 21.0.10, 25.0.2, and 26, as well as Oracle GraalVM versions 17.0.18, 21.0.10, and 21.3.17 Enterprise Edition. The attack complexity is high, and no privileges or user interaction are required. Red Hat has issued a security advisory with updated RPM packages for Red Hat Hardened Images including java-25-openjdk and related packages to fix this issue. The CVSS v3.1 base score assigned by Red Hat is 2.9, reflecting a low confidentiality impact with no integrity or availability impact. The vulnerability can be exploited via APIs, including those used by sandboxed Java Web Start applications or applets running untrusted code.
Potential Impact
The vulnerability allows unauthorized read access to a subset of data accessible by the affected Java components due to the use of broken or risky cryptographic algorithms. There is no impact on data integrity or availability. Exploitation requires local access with high attack complexity and no privileges or user interaction. No known exploits are reported in the wild. The confidentiality impact is low.
Mitigation Recommendations
Red Hat has released updated RPM packages for java-25-openjdk and related components in Red Hat Hardened Images to address this vulnerability. Users should apply these updates as per the Red Hat advisory instructions. No additional mitigations are specified or required beyond applying the official updates. Patch status is confirmed by the vendor advisory.
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Description
This update includes the following RPMs: java-25-openjdk: * java-25-openjdk-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-crypto-adapter-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-crypto-adapter-fastdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-crypto-adapter-slowdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-demo-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-demo-fastdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-demo-slowdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-devel-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-devel-fastdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-devel-slowdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-fastdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-headless-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-headless-fastdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-headless-slowdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-javadoc-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-javadoc-zip-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-jmods-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-jmods-fastdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-jmods-slowdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-slowdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-src-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-src-fastdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-src-slowdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-static-libs-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-static-libs-fastdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-static-libs-slowdebug-25.0.3.0.9-1.hum1 (aarch64, x86_64) * java-25-openjdk-25.0.3.0.9-1.hum1.src (src)
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-22007 is a vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition related to the use of broken or risky cryptographic algorithms (CWE-327). This vulnerability allows an unauthenticated attacker with local access to the infrastructure where these Java components execute to potentially gain unauthorized read access to some data. The vulnerability affects multiple Oracle Java SE versions including 8u481, 11.0.30, 17.0.18, 21.0.10, 25.0.2, and 26, as well as Oracle GraalVM versions 17.0.18, 21.0.10, and 21.3.17 Enterprise Edition. The attack complexity is high, and no privileges or user interaction are required. Red Hat has issued a security advisory with updated RPM packages for Red Hat Hardened Images including java-25-openjdk and related packages to fix this issue. The CVSS v3.1 base score assigned by Red Hat is 2.9, reflecting a low confidentiality impact with no integrity or availability impact. The vulnerability can be exploited via APIs, including those used by sandboxed Java Web Start applications or applets running untrusted code.
Potential Impact
The vulnerability allows unauthorized read access to a subset of data accessible by the affected Java components due to the use of broken or risky cryptographic algorithms. There is no impact on data integrity or availability. Exploitation requires local access with high attack complexity and no privileges or user interaction. No known exploits are reported in the wild. The confidentiality impact is low.
Mitigation Recommendations
Red Hat has released updated RPM packages for java-25-openjdk and related components in Red Hat Hardened Images to address this vulnerability. Users should apply these updates as per the Red Hat advisory instructions. No additional mitigations are specified or required beyond applying the official updates. Patch status is confirmed by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:11902
- Cve Count
- 7
- Additional Cves
- ["CVE-2026-22013","CVE-2026-22016","CVE-2026-22018","CVE-2026-22021","CVE-2026-34268","CVE-2026-34282"]
Threat ID: 6a160979e29bf47b50645843
Added to database: 05/26/2026, 20:58:33 UTC
Last enriched: 08/16/2026, 17:35:59 UTC
Last updated: 09/10/2026, 19:36:52 UTC
Views: 77
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.