Threats Tagged 'cve-2026-47063'

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating multiple java-25-openjdk-portable packages. The advisory addresses a set of vulnerabilities identified by eight CVEs, including CVE-2026-46917 and related issues. The update is classified as a bug fix and enhancement update. No explicit patch details or fixed versions are provided in the advisory. There are no known exploits in the wild reported at this time.

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. This release contains OpenJDK 11 with Extended Lifecycle Support for Red Hat Enterprise Linux versions 7, 8, and 9. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Improve Nashorn index handling (CVE-2026-47057) * JDK: Enhance Dataview Implementation (CVE-2026-47058) * JDK: Update LCMS to 2.19 (CVE-2026-41254) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2026-47063 is a high-severity vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition affecting multiple specified versions. It allows an unauthenticated attacker with network access via multiple protocols to compromise the affected products by unauthorized creation, deletion, or modification of critical data. The vulnerability arises from issues in the Libraries component and can be exploited through APIs, including web services and sandboxed Java applications running untrusted code. The CVSS 3.1 base score is 7.5, indicating a high impact on integrity without affecting confidentiality or availability. Oracle has published a Critical Patch Update advisory addressing multiple vulnerabilities but does not explicitly confirm patch availability for this specific CVE in the provided data.