DSA-6457-1 openjdk-21 - security update
Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in denial of service or information disclosure. https://security-tracker.debian.org/tracker/DSA-6457-1
CSIRTS triage
- What
- Multiple vulnerabilities in OpenJDK Java runtime allow denial of service or information disclosure.
- Who is affected
- OpenJDK 21 deployments; any application running Java on affected systems.
- Urgency
- Moderate; DoS and information disclosure are less critical than RCE but still require prompt remediation.
- Action
- Apply DSA-6457-1 security update to OpenJDK 21.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch OpenJDK 21
Get an email when a new OpenJDK 21 advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://lists.debian.org/debian-security-announce/2026/msg00368.html
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-605890.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-613080.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-709070.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-60589 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-61308 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-70907 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- medium[NEW] [medium] Oracle Java SE: Multiple vulnerabilitiescert-bund
- unknownDSA-6460-1 openjdk-25 - security updatedebian
- unknownNCSC-2026-0314 [1.00] [M/H] Vulnerabilities resolved in Oracle Java SEncsc-nl
- unknownMultiple vulnerabilities in Oracle Java SE (August 19, 2026)cert-fr-avis
- mediumCVE-2026-70907: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition…nvd
- mediumCVE-2026-61308: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition…nvd
- lowCVE-2026-60589: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition…nvd
- lowCVE-2026-60589: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition…msrc
More from Debian Security Advisories
- unknownDSA-6464-1 erlang - security update2026-08-25
- unknownDSA-6465-1 openssl - security update2026-08-25
- unknownDSA-6466-1 linux - security update2026-08-25
- unknownDSA-6462-1 zfs-linux - security update2026-08-24
- unknownDSA-6463-1 webkit2gtk - security update2026-08-24