Back Linuxsecurity

Ubuntu 25.10 OpenJDK 21 Critical Code Exec Issue USN-8002

Linuxsecurity •LinuxSecurity Advisories • February 3, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Several security issues were fixed in OpenJDK 21. Software Description: - openjdk-21: Open Source Java implementation Details: It was discovered that the RMI component of OpenJDK 21 would establish RMI TCP endpoint connections to a remote host without setting an endpoint identification algorithm. An unauthenticated remote attacker could possibly use this issue to steal sensitive information. (CVE-2026-21925) Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 21 could run programs if Desktop.browse() was supplied a filename as a URI. An unauthenticated remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-21932) Zhihui Chen discovered that the Networking component of OpenJDK 21 was suceptible to a CRLF injection vulnerability via the HttpServer

The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 openjdk-21-jdk 21.0.10+7-1~25.10 openjdk-21-jdk-headless 21.0.10+7-1~25.10 openjdk-21-jre 21.0.10+7-1~25.10 openjdk-21-jre-headless 21.0.10+7-1~25.10 openjdk-21-jre-zero 21.0.10+7-1~25.10 Ubuntu 24.04 LTS openjdk-21-jdk 21.0.10+7-1~24.04 openjdk-21-jdk-headless 21.0.10+7-1~24.04 openjdk-21-jre 21.0.10+7-1~24.04 openjdk-21-jre-headless 21.0.10+7-1~24.04 openjdk-21-jre-zero 21.0.10+7-1~24.04 Ubuntu 22.04 LTS openjdk-21-jdk 21.0.10+7-1~22.04 openjdk-21-jdk-headless 21.0.10+7-1~22.04 openjdk-21-jre 21.0.10+7-1~22.04 openjdk-21-jre-headless 21.0.10+7-1~22.04 openjdk-21-jre-zero 21.0.10+7-1~22.04 Ubuntu 20.04 LTS openjdk-21-jdk 21.0.10+7-1~20.04 Available with Ubuntu Pro openjdk-21-jdk-headless 21.0.10+7-1~20.04 Available with Ubuntu Pro openjdk-21-jre 21.0.10+7-1~20.04 Available with Ubuntu Pro openjdk-21-jre-headless 21.0.10+7-1~20.04 Available with Ubuntu Pro openjdk-21-jre-zero 21.0.10+7-1~20.04 Available with Ubuntu Pro This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart Java applications to make all the necessary changes.

CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, CVE-2026-21945

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple OpenJDK Versions Exposed to Remote Information Theft Vulnerabilities Vulnerabilities have been identified in OpenJDK versions 8, 11, and 21, as well as CRaC JDK 21. The RMI component in these versions allows unauthenticated remote attackers to establish TCP endpoint connections without proper endpoint identification, potentially leading to sensitive information theft. The issues were discovered by researcher Mingijung and are associated with CVE-2026-21925. 16 sources 66

Extracted Entities

Ubuntu 25.10 OpenJDK 21 Critical Code Exec Issue USN-8002

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (4)

Platforms (1)

Vulnerabilities (1)