Back Linuxsecurity

Oracle Linux 8 java-21-openjdk Critical Security Notice ELSA-2026

Linuxsecurity •LinuxSecurity Advisories • September 14, 2026

Artifactory Alert: Chained flaws let attackers gain admin control. Check your version now ×

[1:21.0.12.1.1-1.1.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:21.0.12.1.1-1.1] - Update to jdk-21.0.12.1+1 (GA) - Update release notes to 21.0.12.1+1 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235610 [1:21.0.12.0.8-2.1] - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188853 [1:21.0.12.0.8-1.1] - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 1...

java-21-openjdk-21.0.12.1.1-1.1.0.1.el8.x86_64.rpm java-21-openjdk-demo-21.0.12.1.1-1.1.0.1.el8.x86_64.rpm java-21-openjdk-demo-fastdebug-21.0.12.1.1-1.1.0.1.el8.x86_64.rpm java-21-openjdk-demo-slowdebug-21.0.12.1.1-1.1.0.1.el8.x86_64.rpm java-21-openjdk-devel-21.0.12.1.1-1.1.0.1.el8.x86_64.rpm java-21-openjdk-devel-fastdebug-21.0.12.1.1-1.1.0.1.el8.x86_64.rpm java-21-openjdk-devel-slowdebug-21.0.12.1.1-1.1.0.1.el8.x86_64.rpm java-21-openjdk-fastdebug-21.0.12.1.1-1.1.0.1.el8.x86_64.rpm java-21-openjdk-headless-21.0.12.1.1-1.1.0.1.el8.x86_64.rpm java-21-openjdk-headless-fastdebug-21.0.12.1.1-1.1.0.1.el8.x86_64.rpm java-21-openjdk-headless-slowdebug-21.0.12.1.1-1.1.0.1.el8.x86_64.rpm java-21-openjdk-javadoc-21.0.12.1.1-1.1.0.1.el8.x86_64.rpm java-21-openjdk-javadoc-zip-21.0.12.1.1-1.1.0.1.el8.x86_64.rpm java-21-openjdk-jmods-21.0.12.1.1-1.1.0.1.el8.x86_64.rpm java-21-openjdk-jmods-fastdebug-21.0.12.1.1-1.1.0.1.el8.x86_64.rpm java-21-openjdk-jmods-slowdebug-21.0.12.1.1-1.1.0.1.el8.x86_...

java-21-openjdk-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-demo-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-demo-fastdebug-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-demo-slowdebug-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-devel-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-devel-fastdebug-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-devel-slowdebug-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-fastdebug-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-headless-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-headless-fastdebug-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-headless-slowdebug-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-javadoc-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-javadoc-zip-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-jmods-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-jmods-fastdebug-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-jmods-slowdebug-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-slowdebug-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-src-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-src-fastdebug-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-src-slowdebug-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-static-libs-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-static-libs-fastdebug-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm java-21-openjdk-static-libs-slowdebug-21.0.12.1.1-1.1.0.1.el8.aarch64.rpm

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Security Flaws in Oracle Linux Java 21 OpenJDK Oracle has issued critical security advisories for Java 21 OpenJDK, affecting Oracle Linux 8 and 9. Chained vulnerabilities allow attackers to gain administrative control over systems running vulnerable versions. The affected versions include java-21-openjdk-21.0.12.1.1-1.1.0.1 for Oracle Linux 8 and java-21-openjdk-21.0.12.1.1-1.2.0.1 for Oracle Linux 9. The vulnerabilities are linked to CVEs published between April and July 2026, including CVE-2026-41254 and CVE-2026-47021. Administrators are urged to update to the latest versions to mitigate risks. The updates are available as of September 14, 2026, and the advisories emphasize the urgency of applying these patches due to the potential for exploitation. Oracle has provided a vendor bug URL for further details. 3 sources 74

Extracted Entities

CVEs (9)

CVE-2026-41254 CVE-2026-46917 CVE-2026-46968 CVE-2026-47010 CVE-2026-47021 CVE-2026-47027 CVE-2026-47059 CVE-2026-47063 CVE-2026-60147