Red Hat OpenJDK 21.0.13 Updates Fix 38 CVEs
Tech GuruQuick Answer
Red Hat RHSA-2026:90504 updates OpenJDK 21 to 21.0.13 on RHEL 10 channels for 38 CVEs. Inventory installed and embedded runtimes, install the correct signed package, rebuild images, restart Java workloads, validate applications and trust stores, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory RHEL 10 hosts, containers and applications using Red Hat OpenJDK 21, exact packages, embedded copies, trust stores, repositories, owners, and maintenance windows. Match systems to RHSA-2026:90504 and the RHEL 10 channel; do not infer applicability to another JDK vendor, Java line, or unsupported repository. Install the matching java-21-openjdk 21.0.13.0.9 build from the correct signed Red Hat repository, rebuild images, and restart Java processes. Confirm the runtime actually loaded by each service, test TLS, authentication and representative applications, scan images for stale copies, and retain evidence.
Last verified: 2026-10-30 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Red Hat OpenJDK 21 on RHEL 10 and RHEL 10.0 EUS |
|---|---|
| Advisory | RHSA-2026:90504 |
| CVEs | CVE-2026-101516, CVE-2026-83374, CVE-2026-83376, CVE-2026-83378, CVE-2026-83380, CVE-2026-83381, CVE-2026-83387, CVE-2026-83395, CVE-2026-83400, CVE-2026-87290, CVE-2026-87291, CVE-2026-87292, CVE-2026-87294, CVE-2026-87367, CVE-2026-91332, CVE-2026-91333, CVE-2026-91334, CVE-2026-91335, CVE-2026-91373, CVE-2026-91374, CVE-2026-91375, CVE-2026-91379, CVE-2026-91380, CVE-2026-91394, CVE-2026-91397, CVE-2026-91398, CVE-2026-91400, CVE-2026-91410, CVE-2026-91415, CVE-2026-91418, CVE-2026-91451, CVE-2026-91452, CVE-2026-91453, CVE-2026-91461, CVE-2026-91462, CVE-2026-91463, CVE-2026-91464, CVE-2026-91487 |
| Authoritative release date | 2026-10-29 21:42:06 UTC |
| Authority revision date | 2026-10-30 00:53:53 UTC |
| Affected versions | Advisory-listed packages on Red Hat Enterprise Linux AppStream (v. 10); Red Hat Enterprise Linux AppStream EUS (v. 10.0); Red Hat Enterprise Linux CodeReady Linux Builder (v. 10); Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), before the exact fixed builds in the corresponding RHSA. |
| Fixed version | java-21-openjdk-1:21.0.13.0.9-1.1.el10.src; java-21-openjdk-1:21.0.13.0.9-1.2.el10.src |
| CVSS base score | 2.6-6.8 (CVSS v3.1; advisory-specific) |
| CVSS severity | Low to Medium |
| Exploitation status | Red Hat does not state that these vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
One erratum updates OpenJDK 21 across RHEL 10 base, EUS, and CodeReady Builder channels for 38 CVEs. Red Hat rates the grouped errata Important; individual CVSS scores and prerequisites differ by CVE.
What To Validate Now
- Inventory. Inventory RHEL 10 hosts, containers and applications using Red Hat OpenJDK 21, exact packages, embedded copies, trust stores, repositories, owners, and maintenance windows.
- Establish applicability. Match systems to RHSA-2026:90504 and the RHEL 10 channel; do not infer applicability to another JDK vendor, Java line, or unsupported repository.
- Remediate. Install the matching java-21-openjdk 21.0.13.0.9 build from the correct signed Red Hat repository, rebuild images, and restart Java processes.
- Validate. Confirm the runtime actually loaded by each service, test TLS, authentication and representative applications, scan images for stale copies, and retain evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Java updates can change cryptography, certificates and runtime behavior. Test critical applications and trust stores while ensuring embedded runtimes are also replaced.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
