Ubuntu fixes OpenJDK 27 flaws that can expose data
Original title: USN-9005-1: OpenJDK 27 vulnerabilities
USN-9005-1 covers remote authentication failures in 2D and Networking, including CVE-2026-91415 and CVE-2026-83395.
Ubuntu published USN-9005-1 for OpenJDK 27. The 2D component did not correctly authenticate users, so a remote attacker could possibly cause a denial of service or read or modify sensitive data (CVE-2026-91415). Networking issues could let a remote attacker modify data (CVE-2026-91398) or cause denial of service or modify data (CVE-2026-83395). The notice is cut off at a Security component flaw.
Unconfirmed: The notice snippet is truncated, so further CVEs and fixed versions are not shown.
- CVE-2026-91415 is in the OpenJDK 27 2D component.
- CVE-2026-91398 is an authentication failure in Networking.
- CVE-2026-83395 is an authorization failure in Networking.
- Fixed package versions are not in the snippet.
Impact: remote denial of service or read or modify data
| Product | Affected |
|---|---|
| Ubuntu OpenJDK 27 | — |
- 1.Apply the OpenJDK 27 updates in Ubuntu notice USN-9005-1.
- Vendors
- Ubuntu
- Products
- OpenJDK 27
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-91415+2 related CVEs | Input validation flaw in Oracle Java SE 2D component | 7.0 group max | — |
From the original article
It was discovered that the 2D component of OpenJDK 27 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to read or modify sensitive data. (CVE-2026-91415) It was discovered that the Networking component of OpenJDK 27 did not correctly authenticate users.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.