Back Linuxsecurity Ubuntu 25.10 OpenJDK 25 Critical RCE Information Disclosure 7996
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 Summary: Several security issues were fixed in CRaC JDK 25. Software Description: - openjdk-25-crac: Open Source Java implementation with Coordinated Restore at Checkpoints Details: It was discovered that the RMI component of CRaC JDK 25 would establish RMI TCP endpoint connections to a remote host without setting an endpoint identification algorithm. An unauthenticated remote attacker could possibly use this issue to steal sensitive information. (CVE-2026-21925) Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 25 could run programs if Desktop.browse() was supplied a filename as a URI. An unauthenticated remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-21932) Zhihui Chen discovered that the Networking component of CRaC JDK 25 was suceptible to a CRLF injection vulnerability via the HttpServer
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 Summary: Several security issues were fixed in CRaC JDK 25. Software Description: - openjdk-25-crac: Open Source Java implementation with Coordinated Restore at Checkpoints Details: It was discovered that the RMI component of CRaC JDK 25 would establish RMI TCP endpoint connections to a remote host without setting an endpoint identification algorithm. An unauthenticated remote attacker could possibly use this issue to steal sensitive information. (CVE-2026-21925) Mingijung discovered that the AWT and JavaFX componenets of CRaC JDK 25 could run programs if Desktop.browse() was supplied a filename as a URI. An unauthenticated remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-21932) Zhihui Chen discovered that the Networking component of CRaC JDK 25 was suceptible to a CRLF injection vulnerability via the HttpServer
The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 openjdk-25-crac-jdk 25.0.2+10-0ubuntu1~25.10 openjdk-25-crac-jdk-headless 25.0.2+10-0ubuntu1~25.10 openjdk-25-crac-jre 25.0.2+10-0ubuntu1~25.10 openjdk-25-crac-jre-headless 25.0.2+10-0ubuntu1~25.10 openjdk-25-crac-jre-zero 25.0.2+10-0ubuntu1~25.10 This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart Java applications to make all the necessary changes.
The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 openjdk-25-crac-jdk 25.0.2+10-0ubuntu1~25.10 openjdk-25-crac-jdk-headless 25.0.2+10-0ubuntu1~25.10 openjdk-25-crac-jre 25.0.2+10-0ubuntu1~25.10 openjdk-25-crac-jre-headless 25.0.2+10-0ubuntu1~25.10 openjdk-25-crac-jre-zero 25.0.2+10-0ubuntu1~25.10 This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart Java applications to make all the necessary changes.
CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, CVE-2026-21945
CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, CVE-2026-21945
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
