Ubuntu fixes OpenJDK 25 flaws that can expose data
Original title: USN-9004-1: OpenJDK 25 vulnerabilities
USN-9004-1 lists remote flaws in 2D, Networking and JGSS, including CVE-2026-91382.
Ubuntu published USN-9004-1 for OpenJDK 25. A 2D authentication failure could let a remote attacker cause denial of service or read or modify sensitive data (CVE-2026-91415). Networking did not correctly authenticate users, allowing possible modification of sensitive data (CVE-2026-91398). Another 2D issue, CVE-2026-91382, could cause denial of service or data modification. The notice cuts off at a JGSS component flaw.
Unconfirmed: The notice snippet is truncated, so further CVEs and fixed versions are not shown.
- CVE-2026-91415 affects the OpenJDK 25 2D component.
- CVE-2026-91398 is a Networking authentication failure.
- CVE-2026-91382 is a separate 2D authentication failure.
- The snippet ends before the JGSS issue is fully described.
Impact: remote denial of service or read or modify data
| Product | Affected |
|---|---|
| Ubuntu OpenJDK 25 | — |
- 1.Apply the OpenJDK 25 updates in Ubuntu notice USN-9004-1.
- Vendors
- Ubuntu
- Products
- OpenJDK 25
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-91415+2 related CVEs | Input validation flaw in Oracle Java SE 2D component | 7.0 group max | — |
From the original article
It was discovered that the 2D component of OpenJDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to read or modify sensitive data. (CVE-2026-91415) It was discovered that the Networking component of OpenJDK 25 did not correctly authenticate users.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.