DSA-6425-1 openjdk-21 - security update
Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in incorrect validation of certificates or signed Jar files, denial of service or information disclosure. https://security-tracker.debian.org/tracker/DSA-6425-1
CSIRTS triage
- What
- Multiple vulnerabilities in OpenJDK Java runtime may result in incorrect validation of certificates or signed Jar files, denial of service, or information disclosure.
- Who is affected
- Systems running OpenJDK 21 Java runtime.
- Urgency
- Moderate; multiple validation and information disclosure issues warrant timely patching.
- Action
- Upgrade OpenJDK 21 to the version containing the security fixes for CVE-2026-41254, CVE-2026-46917, CVE-2026-46968, CVE-2026-47010, CVE-2026-47021, CVE-2026-47027, CVE-2026-47059, and CVE-2026-47063.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch OpenJDK 21
Get an email when a new OpenJDK 21 advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://lists.debian.org/debian-security-announce/2026/msg00336.html
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-412540.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-469170.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-469680.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-470100.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 16% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-470210.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-470270.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-470590.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-470630.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-601470.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-41254 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-46917 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-46968 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-47010 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-47021 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-47027 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-47059 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-47063 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-60147 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- medium[NEW] [medium] RealObjects PDFreactor: Multiple vulnerabilities enable unspecified attackcert-bund
- medium[NEW] [medium] Oracle Java SE: Multiple vulnerabilitiescert-bund
- unknownexploitedMultiple vulnerabilities in IBM products (August 14, 2026)cert-fr-avis
- unknownDSA-6431-1 openjdk-25 - security updatedebian
- unknownMultiple vulnerabilities in IBM products (August 07, 2026)cert-fr-avis
- lowCVE-2026-47059: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition…msrc
- highCVE-2026-47063: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition…msrc
- mediumCVE-2026-60147: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition…msrc
- mediumCVE-2026-46917: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition…msrc
- unknownMultiple vulnerabilities in Oracle Java SE (July 23, 2026)cert-fr-avis
- unknownNCSC-2026-0261 [1.00] [M/H] Vulnerabilities fixed in Oracle Java SEncsc-nl
- mediumCVE-2026-60147: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition…nvd
More from Debian Security Advisories
- unknownDSA-6443-1 docker.io - security update2026-08-16
- unknownDSA-6444-1 neutron - security update2026-08-16
- unknownDSA-6442-1 util-linux - security update2026-08-14
- unknownDSA-6441-1 python-httplib2 - security update2026-08-14
- unknownDSA-6439-1 zip - security update2026-08-14