Linux · Security advisory · April 28, 2026

RLSA-2026:9689: java-21-openjdk security update

RLSA-2026:9689, released April 28, 2026, fixes 8 CVEs in java-21-openjdk (version 1:21.0.11.0.10-2.el9_7). None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
8
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0070
53rd percentile

Priority of the 8 CVEs

Patch now 0 Urgent 0 High 8 Routine 0

Fixed package versions

ProductReleaseFixed in
java-21-openjdkrocky 91:21.0.11.0.10-2.el9_7

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-22016 Java(TM) SE Development Kit 21 and 1 other: Exposure of Sensitive Information to an Unauthorized Actor 7.6 0.0070 None reported
High CVE-2026-34282 Java(TM) SE Development Kit 21 and 1 other: Uncontrolled Resource Consumption 7.6 0.0064 None reported
High CVE-2026-22021 Java(TM) SE Development Kit 21 and 1 other: Uncontrolled Resource Consumption 7.6 0.0031 None reported
High CVE-2026-22018 Java(TM) SE Development Kit 21 and 1 other: Allocation of Resources Without Limits or Throttling 7.6 0.0027 None reported
High CVE-2026-22013 Java(TM) SE Development Kit 21 and 1 other: Protection Mechanism Failure 7.6 0.0026 None reported
High CVE-2026-23865 An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2. 7.6 0.0017 None reported
High CVE-2026-22007 Java(TM) SE Development Kit 21 and 1 other: Exposure of Sensitive Information to an Unauthorized Actor 7.6 0.0012 None reported
High CVE-2026-34268 Java(TM) SE Development Kit 21 and 1 other: Exposure of Sensitive Information to an Unauthorized Actor 7.6 0.0012 None reported
Showing 1 to 8 of 8 1