Ubuntu fixes OpenJDK 21 flaws that can expose or alter data
Original title: USN-9015-1: OpenJDK 21 vulnerabilities
Remote attackers could modify data via Security and JSSE issues; one Compiler flaw needs no authentication.
Ubuntu security notice USN-9015-1 covers several OpenJDK 21 flaws. The Security and JSSE components did not correctly authenticate or authorize users, so a remote attacker could possibly modify sensitive data (CVE-2026-83374, CVE-2026-83376). The Compiler component did not correctly authorize users, and an unauthenticated remote attacker could possibly read or modify sensitive data (CVE-2026-83378). A JAAS authorization issue is also mentioned, but the feed text is cut off.
Unconfirmed: The feed snippet is truncated and does not state fixed versions or exploitation status.
- CVE-2026-83374 is an OpenJDK 21 Security authentication flaw.
- CVE-2026-83376 is a JSSE authorization flaw that could modify data.
- CVE-2026-83378 allows an unauthenticated remote attacker to read or modify data.
- The notice also mentions a JAAS authorization issue, but the text is truncated.
Impact: Remote read or modification of sensitive data
| Product | Affected |
|---|---|
| Ubuntu OpenJDK 21 | — |
- 1.Apply the Ubuntu update in USN-9015-1 for OpenJDK 21.
- Vendors
- Ubuntu
- Products
- OpenJDK 21
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-83374+2 related CVEs | Unauthenticated integrity flaw in Oracle Java SE Security | 5.9 group max | — |
From the original article
It was discovered that the Security component of OpenJDK 21 did not correctly authenticate users. A remote attacker could possibly use this issue to modify sensitive data. (CVE-2026-83374) It was discovered that the JSSE component of OpenJDK 21 did not correctly authorize users.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.