OpenJDK 8 flaws may let remote attackers read or change data
Original title: USN-9009-1: OpenJDK 8 vulnerabilities
Ubuntu cites four CVEs in Security, JSSE, and JAAS; the notice cuts off before fixes.
Ubuntu reported that OpenJDK 8's Security component did not correctly authenticate users, so a remote attacker could possibly modify sensitive data (CVE-2026-83374). JSSE authorization flaws could likewise allow modification (CVE-2026-83376, CVE-2026-91461). A JAAS flaw could let a remote attacker read sensitive data (CVE-2026-83380). The snippet also starts another Security authorization issue and then cuts off.
Unconfirmed: The notice is truncated, so later issues and fixed versions are not shown.
- CVE-2026-83374 is an OpenJDK 8 Security authentication failure.
- CVE-2026-83376 and CVE-2026-91461 are JSSE authorization flaws.
- CVE-2026-83380 in JAAS could expose sensitive data remotely.
- Fixed versions are not included in the truncated notice.
Impact: remote read or modification of sensitive data
| Product | Affected |
|---|---|
| Ubuntu OpenJDK 8 | OpenJDK 8 |
- 1.Apply Ubuntu's OpenJDK 8 security updates when the fixed packages are published.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-83374+1 related CVE | Unauthenticated integrity flaw in Oracle Java SE Security | 5.9 group max | — | ||
CVE-2026-83380+1 related CVE | Information disclosure in Oracle Java SE JAAS (unauthenticated network) | 5.3 group max | — |
From the original article
It was discovered that the Security component of OpenJDK 8 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the JSSE component of OpenJDK 8 did not correctly authorize users.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.