Threats Tagged 'cve-2026-47027'

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating multiple java-25-openjdk-portable packages. The advisory addresses a set of vulnerabilities identified by eight CVEs, including CVE-2026-46917 and related issues. The update is classified as a bug fix and enhancement update. No explicit patch details or fixed versions are provided in the advisory. There are no known exploits in the wild reported at this time.

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. This release contains OpenJDK 11 with Extended Lifecycle Support for Red Hat Enterprise Linux versions 7, 8, and 9. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Improve Nashorn index handling (CVE-2026-47057) * JDK: Enhance Dataview Implementation (CVE-2026-47058) * JDK: Update LCMS to 2.19 (CVE-2026-41254) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2026-47027 is a vulnerability in Oracle Java SE libraries affecting multiple supported versions including 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1, as well as Oracle GraalVM versions. It allows an unauthenticated attacker with network access via multiple protocols to cause a partial denial of service (partial DoS) without requiring user interaction. The vulnerability can be exploited through APIs, such as web services supplying data to these APIs, and also affects sandboxed Java Web Start applications or applets running untrusted code. The CVSS 3.1 base score is 5.3, indicating a medium severity impact focused on availability. Oracle has published a Critical Patch Update advisory referencing this vulnerability but does not explicitly confirm patch availability or remediation status for this specific issue.