Red Hat OpenJDK 17 Update Addresses 36 CVEs on RHEL 9
Tech GuruQuick Answer
RHSA-2026:90500 updates OpenJDK 17 on supported RHEL 9 streams. Match installed packages and subscriptions, apply the stream-specific build, validate active Java workloads and certificate trust, and retain change evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Java 17 RPMs, RHEL versions, enabled repositories, subscriptions, architecture, application owners, service launch paths and container images. Use the advisory package list and local package-manager applicability results. Java 17 presence alone does not establish exposure, and bundled or non-Red-Hat runtimes need their own vendor guidance. Apply prerequisite errata and the RHSA-2026:90500 packages through the supported Red Hat channel for each system. Rebuild affected images and coordinate application restarts or redeployments where needed to load the updated runtime. Verify installed RPM builds and the runtime used by active services. Test TLS and certificate validation, authentication, representative parsing and application transactions; retain inventories, advisory copies, package transactions and validation results.
Last verified: 2026-11-01 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Red Hat java-17-openjdk runtime and development packages for the RHEL 9 product streams listed in RHSA-2026:90500 |
|---|---|
| Advisory | RHSA-2026:90500 |
| CVEs | CVE-2026-101516, CVE-2026-83374, CVE-2026-83376, CVE-2026-83380, CVE-2026-83381, CVE-2026-83387, CVE-2026-83395, CVE-2026-83400, CVE-2026-87290, CVE-2026-87292, CVE-2026-87294, CVE-2026-87367, CVE-2026-91332, CVE-2026-91334, CVE-2026-91335, CVE-2026-91373, CVE-2026-91374, CVE-2026-91375, CVE-2026-91379, CVE-2026-91380, CVE-2026-91382, CVE-2026-91394, CVE-2026-91397, CVE-2026-91398, CVE-2026-91400, CVE-2026-91410, CVE-2026-91415, CVE-2026-91418, CVE-2026-91451, CVE-2026-91452, CVE-2026-91453, CVE-2026-91461, CVE-2026-91462, CVE-2026-91463, CVE-2026-91464, CVE-2026-91487 |
| Authoritative release date | October 31, 2026 at 22:50:24 UTC |
| Authority revision date | CSAF current release: October 31, 2026 at 23:15:48 UTC (last generated version). The content-update entry is October 31, 2026 at 22:50:24 UTC. |
| Affected versions | Installed java-17-openjdk packages to which RHSA-2026:90500 applies: RHEL 9 AppStream and CodeReady Linux Builder, AppStream E4S 9.2/9.4, and AppStream/CodeReady Linux Builder EUS 9.6. Match the subscribed stream, architecture and package build to the advisory; no universal upstream affected-version range is asserted. |
| Fixed version | java-17-openjdk 1:17.0.21.0.9-2.1.el9 for the listed 9.2/9.4 E4S and 9.6 EUS streams; 1:17.0.21.0.9-2.2.el9 for the listed RHEL 9 main stream. Select the matching architecture and subpackages from RHSA-2026:90500. |
| CVSS base score | 2.6–6.8 (CVSS v3.1; per-CVE base scores) |
| CVSS severity | Low to Medium |
| Exploitation status | Red Hat does not confirm malicious exploitation in this advisory.; no exploitation claim is inferred. |
What Changed
RHSA-2026:90500 supplies OpenJDK 17.0.21 builds addressing 36 CVEs in Java networking, TLS, certificate validation, authentication, image parsing and other components. Red Hat rates the update Important; the individual CVSS v3.1 base scores range from 2.6 to 6.8 and are separate from the vendor impact rating.
What To Validate Now
- Inventory. Inventory Java 17 RPMs, RHEL versions, enabled repositories, subscriptions, architecture, application owners, service launch paths and container images.
- Establish applicability. Use the advisory package list and local package-manager applicability results. Java 17 presence alone does not establish exposure, and bundled or non-Red-Hat runtimes need their own vendor guidance.
- Remediate. Apply prerequisite errata and the RHSA-2026:90500 packages through the supported Red Hat channel for each system. Rebuild affected images and coordinate application restarts or redeployments where needed to load the updated runtime.
- Validate. Verify installed RPM builds and the runtime used by active services. Test TLS and certificate validation, authentication, representative parsing and application transactions; retain inventories, advisory copies, package transactions and validation results.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Avoid switching E4S, EUS or main-stream repositories to obtain a different build. The CSAF remediation lists no required operating-system restart; assess application restart needs separately. Red Hat says OpenJDK RPMs use the system certificate store: address the cited eMudhra certificate issues through ca-certificates updates. CVSS scores describe individual vulnerabilities and do not by themselves establish product applicability or exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
