Ubuntu issues truncated OpenJDK notices for versions 8 through 27
November 9: later notices add OpenJDK 17 and 21, including unauthenticated Compiler flaw CVE-2026-83378.
Ubuntu published six November 9 notices on remote OpenJDK flaws; snippets omit fixes and exploitation status.
On November 9, 2026, Ubuntu published six truncated security notices covering remote authentication and authorization failures in OpenJDK 8, 11, 17, 21, 25, and 27. For OpenJDK 8, 11, 17, and 21, Security, JSSE, and JAAS issues could let a remote attacker modify or read sensitive data. USN-9015-1 also says an unauthenticated remote attacker could read or modify data through an OpenJDK 21 Compiler flaw, CVE-2026-83378. Notices for OpenJDK 25 and 27 cite 2D and Networking flaws that could cause denial of service or allow data to be read or modified. None of the snippets name fixed package versions, and exploitation status is not stated.
- USN-9009-1 and USN-9010-1 cover OpenJDK 8 and 11.
- USN-9014-1 and USN-9015-1 cover OpenJDK 17 and 21.
- CVE-2026-83378 needs no authentication on OpenJDK 21 Compiler.
- OpenJDK 25 and 27 notices cite 2D and Networking flaws.
- Snippets omit fixed package versions and exploitation status.
Timeline
dated events in the reporting · oldest first- Nov 9, 2026Ubuntu publishes USN-9004-1 for OpenJDK 25 · Ubuntu Security Notices
- Nov 9, 2026Ubuntu publishes USN-9005-1 for OpenJDK 27 · Ubuntu Security Notices
- Nov 9, 2026Ubuntu publishes USN-9010-1 for OpenJDK 11 · Ubuntu Security Notices
- Nov 9, 2026Ubuntu publishes USN-9009-1 for OpenJDK 8 · Ubuntu Security Notices
- Nov 9, 2026Ubuntu publishes USN-9014-1 for OpenJDK 17 · Ubuntu Security Notices
- Nov 9, 2026Ubuntu publishes USN-9015-1 for OpenJDK 21 · Ubuntu Security Notices
What each outlet adds
beyond the shared facts- Ubuntu Security NoticesOpenJDK 21 Compiler flaw needs no authentication.
- Ubuntu Security NoticesOpenJDK 11 notice also lists JSSE issue CVE-2026-91461.
- Ubuntu Security NoticesOpenJDK 27 notice adds Networking flaw CVE-2026-83395.
- Ubuntu Security NoticesOpenJDK 25 notice lists separate 2D flaw CVE-2026-91382.
- CVEs
- CVE-2026-83374CVE-2026-83376CVE-2026-91461CVE-2026-83380CVE-2026-83378CVE-2026-91415CVE-2026-91398CVE-2026-83395CVE-2026-91382
- Vendors
- Ubuntu
Coverage
oldest first · one row per article · UTC- · 2d ago
Ubuntu Security NoticesFirst report
Ubuntu fixes OpenJDK 25 flaws that can expose data
USN-9004-1 lists remote flaws in 2D, Networking and JGSS, including CVE-2026-91382.
- · 2d ago
Ubuntu fixes OpenJDK 27 flaws that can expose data
USN-9005-1 covers remote authentication failures in 2D and Networking, including CVE-2026-91415 and CVE-2026-83395.
- · 2d ago
OpenJDK 11 auth flaws may expose or alter data (USN-9010-1)
Ubuntu's notice says remote attackers could modify or read sensitive data via Security, JSSE, and JAAS issues.
- · 2d ago
OpenJDK 8 flaws may let remote attackers read or change data
Ubuntu cites four CVEs in Security, JSSE, and JAAS; the notice cuts off before fixes.
- · 2d ago
Ubuntu fixes OpenJDK 17 flaws that can expose or alter data
Named issues include authentication and JSSE flaws plus a JAAS bug that could expose sensitive data.
- · 2d ago
Ubuntu fixes OpenJDK 21 flaws that can expose or alter data
Remote attackers could modify data via Security and JSSE issues; one Compiler flaw needs no authentication.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91415 | Input validation flaw in Oracle Java SE 2D component | 7.0 group max | — | ||
CVE-2026-83380+1 related CVE | Information disclosure in Oracle Java SE JAAS (unauthenticated network) | 5.3 group max | — |