Red Hat OpenJDK 21.0.13 and 25.0.5 Builds Fix 42 CVEs
Tech GuruQuick Answer
Red Hat published OpenJDK 21.0.13 and 25.0.5 updates for 42 CVEs. Inventory portable Linux and Windows deployments, match the supported line and platform, replace affected runtimes, restart Java workloads, validate applications, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Red Hat OpenJDK 21 and 25 portable Linux and Windows runtimes, embedded copies, containers, applications, trust stores, owners, and deployment pipelines. Match runtime line and platform to RHSA-2026:88348, 88350, or 88351; do not infer that a system JDK, another vendor JDK, or every listed CVE has the same prerequisites. Install Red Hat OpenJDK 21.0.13 or 25.0.5 on the corresponding supported platform, rebuild containers and application bundles, and restart processes so the fixed runtime is active. Confirm the runtime actually loaded by each service, test TLS, authentication and representative applications, scan images for superseded JDKs, and retain package and deployment evidence.
Last verified: 2026-10-29 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Red Hat OpenJDK 21 portable Linux and Windows builds, and OpenJDK 25 portable Linux builds |
|---|---|
| Advisory | RHSA-2026:88348 / RHSA-2026:88350 / RHSA-2026:88351 |
| CVEs | CVE-2026-101516, CVE-2026-114820, CVE-2026-83374, CVE-2026-83376, CVE-2026-83378, CVE-2026-83380, CVE-2026-83381, CVE-2026-83387, CVE-2026-83395, CVE-2026-83400, CVE-2026-87255, CVE-2026-87290, CVE-2026-87291, CVE-2026-87292, CVE-2026-87294, CVE-2026-87367, CVE-2026-91332, CVE-2026-91333, CVE-2026-91334, CVE-2026-91335, CVE-2026-91373, CVE-2026-91374, CVE-2026-91375, CVE-2026-91379, CVE-2026-91380, CVE-2026-91382, CVE-2026-91394, CVE-2026-91397, CVE-2026-91398, CVE-2026-91400, CVE-2026-91403, CVE-2026-91410, CVE-2026-91415, CVE-2026-91418, CVE-2026-91451, CVE-2026-91452, CVE-2026-91453, CVE-2026-91461, CVE-2026-91462, CVE-2026-91463, CVE-2026-91464, CVE-2026-91487 |
| Authoritative release date | 2026-10-29 14:09:31 UTC |
| Authority revision date | 2026-10-29 14:18:09 UTC |
| Affected versions | Advisory-listed Red Hat portable Linux and Windows OpenJDK 21 builds before 21.0.13 and portable Linux OpenJDK 25 builds before 25.0.5. |
| Fixed version | Red Hat OpenJDK 21.0.13 or 25.0.5 for the corresponding platform and maintained product line |
| CVSS base score | 2.6-8.1 (CVSS v3.1) |
| CVSS severity | Critical |
| Exploitation status | Red Hat does not state that these vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Red Hat released portable Linux and Windows OpenJDK updates covering 42 CVEs across the 21 and 25 product lines.
What To Validate Now
- Inventory. Inventory Red Hat OpenJDK 21 and 25 portable Linux and Windows runtimes, embedded copies, containers, applications, trust stores, owners, and deployment pipelines.
- Establish applicability. Match runtime line and platform to RHSA-2026:88348, 88350, or 88351; do not infer that a system JDK, another vendor JDK, or every listed CVE has the same prerequisites.
- Remediate. Install Red Hat OpenJDK 21.0.13 or 25.0.5 on the corresponding supported platform, rebuild containers and application bundles, and restart processes so the fixed runtime is active.
- Validate. Confirm the runtime actually loaded by each service, test TLS, authentication and representative applications, scan images for superseded JDKs, and retain package and deployment evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Java updates can change cryptography, certificates and runtime behavior. Test critical applications and trust stores, but do not leave stale embedded runtimes after updating only the host package.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
