Back Linuxsecurity

Ubuntu 25.10 OpenJDK 17 Critical Risk RCE DoS USN-7998

Linuxsecurity •LinuxSecurity Advisories • February 3, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in OpenJDK 17. Software Description: - openjdk-17: Open Source Java implementation Details: It was discovered that the RMI component of OpenJDK 17 would establish RMI TCP endpoint connections to a remote host without setting an endpoint identification algorithm. An unauthenticated remote attacker could possibly use this issue to steal sensitive information. (CVE-2026-21925) Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 17 could run programs if Desktop.browse() was supplied a filename as a URI. An unauthenticated remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-21932) Zhihui Chen discovered that the Networking component of OpenJDK 17 was suceptible to a CRLF injection vulnerability via the HttpServer

The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 openjdk-17-jdk 17.0.18+8-1~25.10.1 openjdk-17-jdk-headless 17.0.18+8-1~25.10.1 openjdk-17-jre 17.0.18+8-1~25.10.1 openjdk-17-jre-headless 17.0.18+8-1~25.10.1 openjdk-17-jre-zero 17.0.18+8-1~25.10.1 Ubuntu 24.04 LTS openjdk-17-jdk 17.0.18+8-1~24.04.1 openjdk-17-jdk-headless 17.0.18+8-1~24.04.1 openjdk-17-jre 17.0.18+8-1~24.04.1 openjdk-17-jre-headless 17.0.18+8-1~24.04.1 openjdk-17-jre-zero 17.0.18+8-1~24.04.1 Ubuntu 22.04 LTS openjdk-17-jdk 17.0.18+8-1~22.04.1 openjdk-17-jdk-headless 17.0.18+8-1~22.04.1 openjdk-17-jre 17.0.18+8-1~22.04.1 openjdk-17-jre-headless 17.0.18+8-1~22.04.1 openjdk-17-jre-zero 17.0.18+8-1~22.04.1 Ubuntu 20.04 LTS openjdk-17-jdk 17.0.18+8-1~20.04 Available with Ubuntu Pro openjdk-17-jdk-headless 17.0.18+8-1~20.04 Available with Ubuntu Pro openjdk-17-jre 17.0.18+8-1~20.04 Available with Ubuntu Pro openjdk-17-jre-headless 17.0.18+8-1~20.04 Available with Ubuntu Pro openjdk-17-jre-zero 17.0.18+8-1~20.04 Available with Ubuntu Pro Ubuntu 18.04 LTS openjdk-17-jdk 17.0.18+8-1~18.04 Available with Ubuntu Pro openjdk-17-jdk-headless 17.0.18+8-1~18.04 Available with Ubuntu Pro openjdk-17-jre 17.0.18+8-1~18.04 Available with Ubuntu Pro openjdk-17-jre-headless 17.0.18+8-1~18.04 Available with Ubuntu Pro openjdk-17-jre-zero 17.0.18+8-1~18.04 Available with Ubuntu Pro This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart Java applications to make all the necessary changes.

CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, CVE-2026-21945

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple OpenJDK Versions Exposed to Remote Information Theft Vulnerabilities Vulnerabilities have been identified in OpenJDK versions 8, 11, and 21, as well as CRaC JDK 21. The RMI component in these versions allows unauthenticated remote attackers to establish TCP endpoint connections without proper endpoint identification, potentially leading to sensitive information theft. The issues were discovered by researcher Mingijung and are associated with CVE-2026-21925. 16 sources 66

Extracted Entities

Ubuntu 25.10 OpenJDK 17 Critical Risk RCE DoS USN-7998

The full story

Extracted Entities

Attack Types (2)

Companies (1)

CVEs (4)

Platforms (1)

Vulnerabilities (1)