Skip to content

2026/10/21

Openjdk • October 22, 2026

The following vulnerabilities in OpenJDK source code were fixed in this release. The affected versions are 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33, 8u512, and earlier. Please note that defense-in-depth issues are not assigned CVEs. We recommend that you upgrade as soon as possible.

The current and advisories are available for reference.

CVE-2026-91403 concerns eight compromised intermediate CA certificates .

If you use a standalone OpenJDK Java runtime, we recommend that you update it as soon as possible, since it likely contains the compromised certificates. If that is not possible, take immediate action by implementing one of these steps:

Manually block the impacted certificates. First, download the blocked.certs file for your operating system. There is a version for Windows and a version for other operating systems . Find your local $JDK_HOME/lib/security/blocked.certs file. If you have already added entries to this file, create a backup and re-add your entries to the new file. Otherwise, move or replace the blocked.certs file with the downloaded version. For JDK 8, rename blocked.certs to blacklisted.certs ; the file location is the same.

Manually block the impacted certificates. First, download the blocked.certs file for your operating system. There is a version for Windows and a version for other operating systems . Find your local $JDK_HOME/lib/security/blocked.certs file. If you have already added entries to this file, create a backup and re-add your entries to the new file. Otherwise, move or replace the blocked.certs file with the downloaded version. For JDK 8, rename blocked.certs to blacklisted.certs ; the file location is the same.

Enable certificate revocation checking for your application, if not already enabled. For TLS applications, add -Dcom.sun.net.ssl.checkRevocation=true -Dcom.sun.security.enableCRLDP=true to your command line. With JDK 17 and later, for signed JARs, use jarsigner -verify -revcheck -strict $SIGNED_JAR to verify the signed JAR and check revocation.

Enable certificate revocation checking for your application, if not already enabled. For TLS applications, add -Dcom.sun.net.ssl.checkRevocation=true -Dcom.sun.security.enableCRLDP=true to your command line. With JDK 17 and later, for signed JARs, use jarsigner -verify -revcheck -strict $SIGNED_JAR to verify the signed JAR and check revocation.

If you have more than one standalone OpenJDK Java runtime installed, repeat the selected step for all installations.

If you use an OpenJDK Java runtime provided by your operating system, then it most likely uses the operating system’s certificates. This is true of the OpenJDK packages in Arch Linux, Debian, Devuan, Fedora, Gentoo, Oracle Linux, Red Hat Enterprise Linux, and Ubuntu; in these cases, updating the operating system’s certificates is sufficient. This is not true of the OpenJDK packages in FreeBSD and Homebrew, which must be updated directly.

We thank the Leads of the JDK 8 Updates , JDK 11 Updates , JDK 17 Updates , JDK 21 Updates , JDK 25 Updates , and OpenJFX Projects for providing the risk-matrix information for their releases.

How to report a vulnerability

Please see the reporting instructions for information how to report a vulnerability.