RHSA-2026:94069CriticalCVSS 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
November 2, 2026
Last Modified
November 14, 2026

🔗 CVE IDs covered (40)

CVE-2026-83378 →CVE-2026-91334 →CVE-2026-91373 →CVE-2026-91400 →CVE-2026-87290 →CVE-2026-87292 →CVE-2026-91380 →CVE-2026-91397 →CVE-2026-91398 →CVE-2026-87294 →CVE-2026-91379 →CVE-2026-91418 →CVE-2026-91451 →CVE-2026-91463 →CVE-2026-91487 →CVE-2026-114820 →CVE-2026-83381 →CVE-2026-91333 →CVE-2026-91453 →CVE-2026-91464 →CVE-2026-83376 →CVE-2026-83387 →CVE-2026-91374 →CVE-2026-91375 →CVE-2026-91462 →CVE-2026-101516 →CVE-2026-83380 →CVE-2026-83395 →CVE-2026-87367 →CVE-2026-91332 →CVE-2026-91335 →CVE-2026-91394 →CVE-2026-91410 →CVE-2026-91415 →CVE-2026-91452 →CVE-2026-83374 →CVE-2026-83400 →CVE-2026-87291 →CVE-2026-91403 →CVE-2026-91461 →

📋 Description

CVE-2026-83374 — openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10) CVE-2026-83376 — openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10) CVE-2026-83378 — openjdk: Improve C2 loop transformations (Oracle CPU 2026-10) CVE-2026-83380 — openjdk: Enhance LDAP logins (Oracle CPU 2026-10) CVE-2026-83381 — openjdk: Enhance SASL Authentication (Oracle CPU 2026-10) CVE-2026-83387 — openjdk: Enhance WebRowSets (Oracle CPU 2026-10) CVE-2026-83395 — openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10) CVE-2026-83400 — openjdk: Enhance XML Processing (Oracle CPU 2026-10) CVE-2026-87290 — openjdk: Enhance XPath Expressions (Oracle CPU 2026-10) CVE-2026-87291 — openjdk: Enhance HTTP Server (Oracle CPU 2026-10) CVE-2026-87292 — openjdk: Enhance Network Clients (Oracle CPU 2026-10) CVE-2026-87294 — openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10) CVE-2026-87367 — openjdk: Enhance Template Handling (Oracle CPU 2026-10) CVE-2026-91332 — openjdk: Enhance HTTP Client (Oracle CPU 2026-10) CVE-2026-91333 — openjdk: Improve ciphertext handling (Oracle CPU 2026-10) CVE-2026-91334 — openjdk: Enhance JPEG loading (Oracle CPU 2026-10) CVE-2026-91335 — openjdk: Enhance Image Handling (Oracle CPU 2026-10) CVE-2026-91373 — openjdk: Enhance TLS handshakes (Oracle CPU 2026-10) CVE-2026-91374 — openjdk: Enhance jstatd (Oracle CPU 2026-10) CVE-2026-91375 — openjdk: Enhance jmod handling (Oracle CPU 2026-10) CVE-2026-91379 — openjdk: Enhance JShell (Oracle CPU 2026-10) CVE-2026-91380 — openjdk: Enhance Preferences (Oracle CPU 2026-10) CVE-2026-91394 — openjdk: Enhance HTTP client caching (Oracle CPU 2026-10) CVE-2026-91397 — openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10) CVE-2026-91398 — openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10) CVE-2026-91400 — openjdk: Enhance MIDI file handling (Oracle CPU 2026-10) CVE-2026-91403 — OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-91410 — openjdk: Enhance zipfs (Oracle CPU 2026-10) CVE-2026-91415 — openjdk: Enhance font rendering (Oracle CPU 2026-10) CVE-2026-91418 — openjdk: Enhance GIF loading (Oracle CPU 2026-10) CVE-2026-91451 — openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10) CVE-2026-91452 — openjdk: Enhance HTTP server (Oracle CPU 2026-10) CVE-2026-91453 — openjdk: Improve HTTP headers (Oracle CPU 2026-10) CVE-2026-91461 — openjdk: Enhance TLS Extensions (Oracle CPU 2026-10) CVE-2026-91462 — openjdk: Enhance krb5 tokens (Oracle CPU 2026-10) CVE-2026-91463 — openjdk: Enhance krb5 client (Oracle CPU 2026-10) CVE-2026-91464 — openjdk: Enhance Kerberos validation (Oracle CPU 2026-10) CVE-2026-91487 — openjdk: Enhance C2 comparisons (Oracle CPU 2026-10) CVE-2026-101516 — openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10) CVE-2026-114820 — OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns

🎯 Affected products35

  • Red Hat Hardened Images
  • java-21-openjdk-portable-1:21.0.13.0.9-1.0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-1:21.0.13.0.9-1.0.1.hum1@s390x as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-1:21.0.13.0.9-1.0.1.hum1@src as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-1:21.0.13.0.9-1.0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-devel-1:21.0.13.0.9-1.0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-devel-1:21.0.13.0.9-1.0.1.hum1@s390x as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-devel-1:21.0.13.0.9-1.0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-devel-fastdebug-1:21.0.13.0.9-1.0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-devel-fastdebug-1:21.0.13.0.9-1.0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-devel-slowdebug-1:21.0.13.0.9-1.0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-devel-slowdebug-1:21.0.13.0.9-1.0.1.hum1@s390x as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-devel-slowdebug-1:21.0.13.0.9-1.0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-docs-1:21.0.13.0.9-1.0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-docs-1:21.0.13.0.9-1.0.1.hum1@s390x as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-docs-1:21.0.13.0.9-1.0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-fastdebug-1:21.0.13.0.9-1.0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-fastdebug-1:21.0.13.0.9-1.0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-misc-1:21.0.13.0.9-1.0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-misc-1:21.0.13.0.9-1.0.1.hum1@s390x as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-misc-1:21.0.13.0.9-1.0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-slowdebug-1:21.0.13.0.9-1.0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-slowdebug-1:21.0.13.0.9-1.0.1.hum1@s390x as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-slowdebug-1:21.0.13.0.9-1.0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-sources-1:21.0.13.0.9-1.0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-sources-1:21.0.13.0.9-1.0.1.hum1@s390x as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-sources-1:21.0.13.0.9-1.0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-static-libs-1:21.0.13.0.9-1.0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-static-libs-1:21.0.13.0.9-1.0.1.hum1@s390x as a component of Red Hat Hardened Images
  • java-21-openjdk-portable-static-libs-1:21.0.13.0.9-1.0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • +5 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Users of OpenJDK RPM packages in Red Hat Enterprise Linux can resolve this issue by installing updated ca-certificates packages fixing CVE-2026-114406. Also refer to the detailed information in the RHSB-2026-012 security bulletin for other mitigation steps if updating ca-certificates packages is not possible.

🔗 References (44)