Linux · Security advisory · November 7, 2026

ALSA-2026:88347: Security update for 26 packages

ALSA-2026:88347, released November 7, 2026, fixes 41 CVEs across 26 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent

CVEs closed

1 rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0044

38th percentile

Priority of the 41 CVEs

Patch now 0
                                Urgent 1
                                High 2
                                Routine 38

Fixed package versions

Product	Release	Fixed in
java-25-openjdk	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-crypto-adapter	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-crypto-adapter	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-crypto-adapter-fastdebug	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-crypto-adapter-fastdebug	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-crypto-adapter-slowdebug	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-crypto-adapter-slowdebug	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-demo	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-demo	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-demo-fastdebug	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-demo-fastdebug	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-demo-slowdebug	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-demo-slowdebug	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-devel	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-devel	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-devel-fastdebug	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-devel-fastdebug	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-devel-slowdebug	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-devel-slowdebug	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-fastdebug	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-fastdebug	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-headless	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-headless	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-headless-fastdebug	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-headless-fastdebug	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-headless-slowdebug	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-headless-slowdebug	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-javadoc	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-javadoc	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-javadoc-zip	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-javadoc-zip	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-jmods	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-jmods	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-jmods-fastdebug	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-jmods-fastdebug	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-jmods-slowdebug	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-jmods-slowdebug	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-slowdebug	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-slowdebug	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-src	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-src	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-src-fastdebug	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-src-fastdebug	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-src-slowdebug	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-src-slowdebug	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-static-libs	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-static-libs	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-static-libs-fastdebug	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-static-libs-fastdebug	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1
java-25-openjdk-static-libs-slowdebug	almalinux 10	1:25.0.5.0.8-1.0.el10.alma.1
java-25-openjdk-static-libs-slowdebug	almalinux 9	1:25.0.5.0.8-1.0.el9.alma.1

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
Urgent	CVE-2026-91403	Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in th	9.1	0.0038	None reported
High	CVE-2026-114820	java-21-openjdk: The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit	8.1	0.0025	None reported
High	CVE-2026-91415	java-17-openjdk: The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Develop...	7.0	0.0024	None reported
Routine	CVE-2026-91373	java-17-openjdk: The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Develop...	6.8	0.0044	None reported
Routine	CVE-2026-91394	java-17-openjdk: The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Develop...	6.8	0.0042	None reported
Routine	CVE-2026-91418	java-17-openjdk: The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Develop...	6.8	0.0040	None reported
Routine	CVE-2026-83400	java-17-openjdk: The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Develop...	6.8	0.0040	None reported
Routine	CVE-2026-83387	Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JDBC). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients runn	6.8	0.0033	None reported
Routine	CVE-2026-83395	java-25-openjdk-crypto-adapter-slowdebug: The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit	6.8	0.0033	None reported
Routine	CVE-2026-87290	Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running s	6.8	0.0033	None reported
Routine	CVE-2026-83380	Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAAS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web St	6.8	0.0033	None reported
Routine	CVE-2026-87255	java-25-openjdk: The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit	6.8	0.0031	None reported
Routine	CVE-2026-87291	java-21-openjdk: The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit	6.8	0.0031	None reported
Routine	CVE-2026-91410	java-17-openjdk: The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Develop...	6.8	0.0031	None reported
Routine	CVE-2026-91332	java-17-openjdk: The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Develop...	6.8	0.0029	None reported
Routine	CVE-2026-91451	java-17-openjdk: The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Develop...	6.8	0.0029	None reported
Routine	CVE-2026-91452	java-17-openjdk: The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Develop...	6.8	0.0029	None reported
Routine	CVE-2026-91453	java-17-openjdk: The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Develop...	6.8	0.0029	None reported
Routine	CVE-2026-83374	Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typic	6.8	0.0029	None reported
Routine	CVE-2026-91464	java-17-openjdk: The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Develop...	6.8	0.0029	None reported
Routine	CVE-2026-101516	openjdk-21: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java...	6.8	0.0028	None reported
Routine	CVE-2026-91462	java-17-openjdk: The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Develop...	6.8	0.0027	None reported
Routine	CVE-2026-91333	java-21-openjdk: The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit	6.8	0.0027	None reported
Routine	CVE-2026-87294	Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.	6.8	0.0026	None reported
Routine	CVE-2026-91400	java-17-openjdk: The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Develop...	6.8	0.0026	None reported

Also fixes CVE-2026-91403

ALAS2023-2026-3315
java-1.8.0-amazon-corretto, java-1.8.0-amazon-corretto-debugsymbols, java-1.8.0-amazon-corretto-devel on amzn 2023
ALAS2023-2026-3317
java-11-amazon-corretto, java-11-amazon-corretto-debugsymbols, java-11-amazon-corretto-devel and 3 more on amzn 2023
ALAS2023-2026-3318
java-17-amazon-corretto, java-17-amazon-corretto-debugsymbols, java-17-amazon-corretto-devel and 3 more on amzn 2023
ALAS2023-2026-3319
java-21-amazon-corretto, java-21-amazon-corretto-debugsymbols, java-21-amazon-corretto-devel and 3 more on amzn 2023
ALAS2023-2026-3320
java-25-amazon-corretto, java-25-amazon-corretto-debugsymbols, java-25-amazon-corretto-devel and 3 more on amzn 2023
ALAS2023-2026-3316
java-27-amazon-corretto, java-27-amazon-corretto-debugsymbols, java-27-amazon-corretto-devel and 3 more on amzn 2023
ALSA-2026:88349
java-21-openjdk, java-21-openjdk-demo, java-21-openjdk-demo-fastdebug and 20 more on almalinux 8, almalinux 9
ALSA-2026:90504
java-21-openjdk, java-21-openjdk-demo, java-21-openjdk-demo-fastdebug and 20 more on almalinux 10

Vendor advisory

https://osv.dev/vulnerability/ALSA-2026:88347

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo