Back Linuxsecurity

Ubuntu OpenJDK 11 Key Remote Code Execution Advisory USN-8001

Linuxsecurity •LinuxSecurity Advisories • February 3, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in OpenJDK 11. Software Description: - openjdk-lts: Open Source Java implementation Details: It was discovered that the RMI component of OpenJDK 11 would establish RMI TCP endpoint connections to a remote host without setting an endpoint identification algorithm. An unauthenticated remote attacker could possibly use this issue to steal sensitive information. (CVE-2026-21925) Mingijung discovered that the AWT and JavaFX componenets of OpenJDK 11 could run programs if Desktop.browse() was supplied a filename as a URI. An unauthenticated remote attacker could possibly use this issue to execute arbitrary code. (CVE-2026-21932) Zhihui Chen discovered that the Networking component of OpenJDK 11 was suceptible to a CRLF injection vulnerability via the HttpServer

The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 openjdk-11-jdk 11.0.30+7-1ubuntu1~25.10 openjdk-11-jdk-headless 11.0.30+7-1ubuntu1~25.10 openjdk-11-jre 11.0.30+7-1ubuntu1~25.10 openjdk-11-jre-headless 11.0.30+7-1ubuntu1~25.10 openjdk-11-jre-zero 11.0.30+7-1ubuntu1~25.10 Ubuntu 24.04 LTS openjdk-11-jdk 11.0.30+7-1ubuntu1~24.04 openjdk-11-jdk-headless 11.0.30+7-1ubuntu1~24.04 openjdk-11-jre 11.0.30+7-1ubuntu1~24.04 openjdk-11-jre-headless 11.0.30+7-1ubuntu1~24.04 openjdk-11-jre-zero 11.0.30+7-1ubuntu1~24.04 Ubuntu 22.04 LTS openjdk-11-jdk 11.0.30+7-1ubuntu1~22.04 openjdk-11-jdk-headless 11.0.30+7-1ubuntu1~22.04 openjdk-11-jre 11.0.30+7-1ubuntu1~22.04 openjdk-11-jre-headless 11.0.30+7-1ubuntu1~22.04 openjdk-11-jre-zero 11.0.30+7-1ubuntu1~22.04 Ubuntu 20.04 LTS openjdk-11-jdk 11.0.30+7-1ubuntu1~20.04 Available with Ubuntu Pro openjdk-11-jdk-headless 11.0.30+7-1ubuntu1~20.04 Available with Ubuntu Pro openjdk-11-jre 11.0.30+7-1ubuntu1~20.04 Available with Ubuntu Pro openjdk-11-jre-headless 11.0.30+7-1ubuntu1~20.04 Available with Ubuntu Pro openjdk-11-jre-zero 11.0.30+7-1ubuntu1~20.04 Available with Ubuntu Pro Ubuntu 18.04 LTS openjdk-11-jdk 11.0.30+7-1ubuntu1~18.04 Available with Ubuntu Pro openjdk-11-jdk-headless 11.0.30+7-1ubuntu1~18.04 Available with Ubuntu Pro openjdk-11-jre 11.0.30+7-1ubuntu1~18.04 Available with Ubuntu Pro openjdk-11-jre-headless 11.0.30+7-1ubuntu1~18.04 Available with Ubuntu Pro openjdk-11-jre-zero 11.0.30+7-1ubuntu1~18.04 Available with Ubuntu Pro This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart Java applications to make all the necessary changes.

CVE-2026-21925, CVE-2026-21932, CVE-2026-21933, CVE-2026-21945

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple OpenJDK Versions Exposed to Remote Information Theft Vulnerabilities Vulnerabilities have been identified in OpenJDK versions 8, 11, and 21, as well as CRaC JDK 21. The RMI component in these versions allows unauthenticated remote attackers to establish TCP endpoint connections without proper endpoint identification, potentially leading to sensitive information theft. The issues were discovered by researcher Mingijung and are associated with CVE-2026-21925. 16 sources 66

Extracted Entities

Ubuntu OpenJDK 11 Key Remote Code Execution Advisory USN-8001

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (4)

Platforms (1)