DSA-6460-1 openjdk-25 - security update
Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in denial of service or information disclosure. https://security-tracker.debian.org/tracker/DSA-6460-1
CSIRTS triage
- What
- Several vulnerabilities in OpenJDK Java runtime may result in denial of service or information disclosure.
- Who is affected
- Systems running OpenJDK 25.
- Urgency
- Apply patches promptly as DoS and information disclosure vulnerabilities can impact availability and confidentiality.
- Action
- Update OpenJDK to the patched version specified in DSA-6460-1.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch OpenJDK
Get an email when a new OpenJDK advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://lists.debian.org/debian-security-announce/2026/msg00371.html
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-605890.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-613080.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-709060.44% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-709070.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-60589 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-61308 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-70906 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-70907 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- medium[NEW] [medium] Oracle Java SE: Multiple vulnerabilitiescert-bund
- unknownDSA-6457-1 openjdk-21 - security updatedebian
- unknownNCSC-2026-0314 [1.00] [M/H] Vulnerabilities resolved in Oracle Java SEncsc-nl
- unknownMultiple vulnerabilities in Oracle Java SE (August 19, 2026)cert-fr-avis
- mediumCVE-2026-70907: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition…nvd
- highCVE-2026-70906: Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Orac…nvd
- mediumCVE-2026-61308: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition…nvd
- lowCVE-2026-60589: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition…nvd
- lowCVE-2026-60589: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition…msrc
More from Debian Security Advisories
- unknownDSA-6464-1 erlang - security update2026-08-25
- unknownDSA-6465-1 openssl - security update2026-08-25
- unknownDSA-6466-1 linux - security update2026-08-25
- unknownDSA-6462-1 zfs-linux - security update2026-08-24
- unknownDSA-6463-1 webkit2gtk - security update2026-08-24