Multiple CRaC JDK and OpenJDK Vulnerabilities Discovered

On May 28, 2026, Ubuntu published security notices for vulnerabilities in various Java Development Kits (JDKs). Discovered by Thomas Beckers, these vulnerabilities affect CRaC JDK 25, JDK 21, JDK 17, OpenJDK 11, and OpenJDK 8. Key issues include improper authentication in components like JAXP, JSSE, and Networking, allowing remote unauthenticated attackers to gain unauthorized access to sensitive information or cause denial of service. Specific CVEs include CVE-2026-22016, CVE-2026-34282, and CVE-2026-22021, all published on April 21, 2026. The vulnerabilities pose a significant risk to systems utilizing these JDK versions, necessitating immediate patching by affected users. The current status indicates that users should update their systems to mitigate these risks.

Key Points: • Multiple vulnerabilities found in CRaC JDK and OpenJDK versions, affecting authentication. • Remote unauthenticated attackers can exploit these vulnerabilities for unauthorized access. • Immediate patching is required for affected systems to prevent potential exploits.