Back Linuxsecurity Ubuntu 25.10 OpenJDK 17 Important RMI Info Disclosure 7997-1 CVE-2026
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 Summary: Several security issues were fixed in CRaC JDK 17. Software Description: - openjdk-17-crac: Open Source Java implementation with Coordinated Restore at Checkpoints Details: It was discovered that the RMI component of CRaC JDK 17 would establish RMI TCP endpoint connections to a remote host without setting an endpoint identification algorithm. An unauthenticated remote attacker could possibly use this issue to steal sensitive information. (CVE-2026-21925) Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 17 could run programs if Desktop.browse() was supplied a filename as a URI. An unauthenticated remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-21932) Zhihui Chen discovered that the Networking component of CRaC JDK 17 was suceptible to a CRLF injection vulnerability via the HttpServer
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 Summary: Several security issues were fixed in CRaC JDK 17. Software Description: - openjdk-17-crac: Open Source Java implementation with Coordinated Restore at Checkpoints Details: It was discovered that the RMI component of CRaC JDK 17 would establish RMI TCP endpoint connections to a remote host without setting an endpoint identification algorithm. An unauthenticated remote attacker could possibly use this issue to steal sensitive information. (CVE-2026-21925) Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 17 could run programs if Desktop.browse() was supplied a filename as a URI. An unauthenticated remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-21932) Zhihui Chen discovered that the Networking component of CRaC JDK 17 was suceptible to a CRLF injection vulnerability via the HttpServer
The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 openjdk-17-crac-jdk 17.0.18+8-0ubuntu1~25.10 openjdk-17-crac-jdk-headless 17.0.18+8-0ubuntu1~25.10 openjdk-17-crac-jre 17.0.18+8-0ubuntu1~25.10 openjdk-17-crac-jre-headless 17.0.18+8-0ubuntu1~25.10 openjdk-17-crac-jre-zero 17.0.18+8-0ubuntu1~25.10 This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart Java applications to make all the necessary changes.
The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 openjdk-17-crac-jdk 17.0.18+8-0ubuntu1~25.10 openjdk-17-crac-jdk-headless 17.0.18+8-0ubuntu1~25.10 openjdk-17-crac-jre 17.0.18+8-0ubuntu1~25.10 openjdk-17-crac-jre-headless 17.0.18+8-0ubuntu1~25.10 openjdk-17-crac-jre-zero 17.0.18+8-0ubuntu1~25.10 This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart Java applications to make all the necessary changes.
CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, CVE-2026-21945
CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, CVE-2026-21945
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
