Back Linuxsecurity Ubuntu 25.10 OpenJDK-21-crac Important Remote Access Threat USN-8003
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 Summary: Several security issues were fixed in CRaC JDK 21. Software Description: - openjdk-21-crac: Open Source Java implementation with Coordinated Restore at Checkpoints Details: It was discovered that the RMI component of CRaC JDK 21 would establish RMI TCP endpoint connections to a remote host without setting an endpoint identification algorithm. An unauthenticated remote attacker could possibly use this issue to steal sensitive information. (CVE-2026-21925) Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 21 could run programs if Desktop.browse() was supplied a filename as a URI. An unauthenticated remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-21932) Zhihui Chen discovered that the Networking component of CRaC JDK 21 was suceptible to a CRLF injection vulnerability via the HttpServer
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 Summary: Several security issues were fixed in CRaC JDK 21. Software Description: - openjdk-21-crac: Open Source Java implementation with Coordinated Restore at Checkpoints Details: It was discovered that the RMI component of CRaC JDK 21 would establish RMI TCP endpoint connections to a remote host without setting an endpoint identification algorithm. An unauthenticated remote attacker could possibly use this issue to steal sensitive information. (CVE-2026-21925) Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 21 could run programs if Desktop.browse() was supplied a filename as a URI. An unauthenticated remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-21932) Zhihui Chen discovered that the Networking component of CRaC JDK 21 was suceptible to a CRLF injection vulnerability via the HttpServer
The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 openjdk-21-crac-demo 21.0.10+7-0ubuntu1~25.10 openjdk-21-crac-doc 21.0.10+7-0ubuntu1~25.10 openjdk-21-crac-jdk 21.0.10+7-0ubuntu1~25.10 openjdk-21-crac-jdk-headless 21.0.10+7-0ubuntu1~25.10 openjdk-21-crac-jre 21.0.10+7-0ubuntu1~25.10 openjdk-21-crac-jre-headless 21.0.10+7-0ubuntu1~25.10 openjdk-21-crac-jre-zero 21.0.10+7-0ubuntu1~25.10 openjdk-21-crac-source 21.0.10+7-0ubuntu1~25.10 openjdk-21-crac-testsupport 21.0.10+7-0ubuntu1~25.10 This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart Java applications to make all the necessary changes.
The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 openjdk-21-crac-demo 21.0.10+7-0ubuntu1~25.10 openjdk-21-crac-doc 21.0.10+7-0ubuntu1~25.10 openjdk-21-crac-jdk 21.0.10+7-0ubuntu1~25.10 openjdk-21-crac-jdk-headless 21.0.10+7-0ubuntu1~25.10 openjdk-21-crac-jre 21.0.10+7-0ubuntu1~25.10 openjdk-21-crac-jre-headless 21.0.10+7-0ubuntu1~25.10 openjdk-21-crac-jre-zero 21.0.10+7-0ubuntu1~25.10 openjdk-21-crac-source 21.0.10+7-0ubuntu1~25.10 openjdk-21-crac-testsupport 21.0.10+7-0ubuntu1~25.10 This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart Java applications to make all the necessary changes.
CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, CVE-2026-21945
CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, CVE-2026-21945
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
