Back Linuxsecurity

Ubuntu 25 OpenJDK 25 Important Security Threats USN-7995

Linuxsecurity •LinuxSecurity Advisories • February 3, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Several security issues were fixed in OpenJDK 25. Software Description: - openjdk-25: Open Source Java implementation Details: It was discovered that the RMI component of OpenJDK 25 would establish RMI TCP endpoint connections to a remote host without setting an endpoint identification algorithm. An unauthenticated remote attacker could possibly use this issue to steal sensitive information. (CVE-2026-21925) Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 25 could run programs if Desktop.browse() was supplied a filename as a URI. An unauthenticated remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-21932) Zhihui Chen discovered that the Networking component of OpenJDK 25 was suceptible to a CRLF injection vulnerability via the HttpServer

The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 openjdk-25-jdk 25.0.2+10-1~25.10 openjdk-25-jdk-headless 25.0.2+10-1~25.10 openjdk-25-jre 25.0.2+10-1~25.10 openjdk-25-jre-headless 25.0.2+10-1~25.10 openjdk-25-jre-zero 25.0.2+10-1~25.10 openjdk-25-jvmci-jdk 25.0.2+10-1~25.10 Ubuntu 24.04 LTS openjdk-25-jdk 25.0.2+10-1~24.04 openjdk-25-jdk-headless 25.0.2+10-1~24.04 openjdk-25-jre 25.0.2+10-1~24.04 openjdk-25-jre-headless 25.0.2+10-1~24.04 openjdk-25-jre-zero 25.0.2+10-1~24.04 openjdk-25-jvmci-jdk 25.0.2+10-1~24.04 Ubuntu 22.04 LTS openjdk-25-jdk 25.0.2+10-1~22.04 openjdk-25-jdk-headless 25.0.2+10-1~22.04 openjdk-25-jre 25.0.2+10-1~22.04 openjdk-25-jre-headless 25.0.2+10-1~22.04 openjdk-25-jre-zero 25.0.2+10-1~22.04 openjdk-25-jvmci-jdk 25.0.2+10-1~22.04 This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart Java applications to make all the necessary changes.

CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, CVE-2026-21945

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple OpenJDK Versions Exposed to Remote Information Theft Vulnerabilities Vulnerabilities have been identified in OpenJDK versions 8, 11, and 21, as well as CRaC JDK 21. The RMI component in these versions allows unauthenticated remote attackers to establish TCP endpoint connections without proper endpoint identification, potentially leading to sensitive information theft. The issues were discovered by researcher Mingijung and are associated with CVE-2026-21925. 16 sources 66

Extracted Entities

Ubuntu 25 OpenJDK 25 Important Security Threats USN-7995

The full story

Extracted Entities

Companies (1)

CVEs (4)

Platforms (1)

Vulnerabilities (1)