← All notices | Source (USN-8674-1) | Text version
QSN-8674-1: OpenJDK 11 vulnerabilities
August 25, 2026
Summary
Several security issues were fixed in OpenJDK 11.
Details
It was discovered that the JSSE component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-46968)
It was discovered that the JSSE component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-46917)
It was discovered that the ImageIO component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-47010)
It was discovered that the 2D component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-47021, CVE-2026-47059)
It was discovered that the Libraries component of OpenJDK 11 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-47027)
It was discovered that the Security component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-60147)
It was discovered that the Libraries component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-47063)
It was discovered that the Scripting component of OpenJDK 11 did not correctly authenticate users. A remote attacker could possibly use this issue to cause a denial of service or to read or modify sensitive data. (CVE-2026-47057, CVE-2026-47058)
Lian Owen discovered that the 2D (Little CMS) component of OpenJDK 11 did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-41254)
In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.
Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2026-07-21
Affected QuantaStor releases
| Release | Platform | Package | Exposure | Shipped version | Fixed version | Status |
|---|---|---|---|---|---|---|
| 6.8.6.015 | Ubuntu 22.04 LTS | openjdk-11-jre-headless | Externally-facing | 11.0.32+9-1ubuntu1~22.04 | 11.0.32+9-1ubuntu1~22.04 | Fixed in this release |
| 6.8.5.018 | Ubuntu 22.04 LTS | openjdk-11-jre-headless | Externally-facing | 11.0.31+11-1ubuntu1~22.04.2 | 11.0.32+9-1ubuntu1~22.04 | Fixed by QuantaStor security update |
| 6.8.4.038 | Ubuntu 22.04 LTS | openjdk-11-jre-headless | Externally-facing | 11.0.31+11-1ubuntu1~22.04.2 | 11.0.32+9-1ubuntu1~22.04 | Fixed by QuantaStor security update |
| 6.8.3.018 | Ubuntu 22.04 LTS | openjdk-11-jre-headless | Externally-facing | 11.0.31+11-1ubuntu1~22.04.2 | 11.0.32+9-1ubuntu1~22.04 | Fixed by QuantaStor security update |
| 6.8.2.002 | Ubuntu 22.04 LTS | openjdk-11-jre-headless | Externally-facing | 11.0.31+11-1ubuntu1~22.04.2 | 11.0.32+9-1ubuntu1~22.04 | Fixed by QuantaStor security update |
| 6.8.1.007 | Ubuntu 22.04 LTS | openjdk-11-jre-headless | Externally-facing | 11.0.31+11-1ubuntu1~22.04.2 | 11.0.32+9-1ubuntu1~22.04 | Fixed by QuantaStor security update |
| 6.8.0.205 | Ubuntu 22.04 LTS | openjdk-11-jre-headless | Externally-facing | 11.0.31+11-1ubuntu1~22.04.2 | 11.0.32+9-1ubuntu1~22.04 | Fixed by QuantaStor security update |
Internally-facing: only accessible when logged into the QuantaStor console/ssh as the qadmin administrative sudo user; generally lower priority. Externally-facing: part of a service the storage platform presents on the network (or the kernel), so potentially reachable over the network.
CVEs
CVE-2026-60147, CVE-2026-46917, CVE-2026-47010, CVE-2026-41254, CVE-2026-47027, CVE-2026-47058, CVE-2026-47063, CVE-2026-46968, CVE-2026-47059, CVE-2026-47057, CVE-2026-47021
References
https://ubuntu.com/security/notices/USN-8674-1
https://nvd.nist.gov/vuln/detail/CVE-2026-60147
https://nvd.nist.gov/vuln/detail/CVE-2026-46917
https://nvd.nist.gov/vuln/detail/CVE-2026-47010
https://nvd.nist.gov/vuln/detail/CVE-2026-41254
https://nvd.nist.gov/vuln/detail/CVE-2026-47027
https://nvd.nist.gov/vuln/detail/CVE-2026-47058
https://nvd.nist.gov/vuln/detail/CVE-2026-47063
https://nvd.nist.gov/vuln/detail/CVE-2026-46968
https://nvd.nist.gov/vuln/detail/CVE-2026-47059
https://nvd.nist.gov/vuln/detail/CVE-2026-47057
https://nvd.nist.gov/vuln/detail/CVE-2026-47021
Update
Fixes marked Fixed by QuantaStor security update are applied by upgrading QuantaStor with security patches included (Upgrade Manager). Fixed package versions:
| Platform | Package | Version |
|---|---|---|
| bionic | openjdk-lts | 11.0.32+9-1ubuntu1~18.04 |
| Ubuntu 20.04 LTS | openjdk-lts | 11.0.32+9-1ubuntu1~20.04 |
| Ubuntu 22.04 LTS | openjdk-lts | 11.0.32+9-1ubuntu1~22.04 |
| Ubuntu 24.04 LTS | openjdk-lts | 11.0.32+9-1ubuntu1~24.04 |
| resolute | openjdk-lts | 11.0.32+9-1ubuntu1~26.04 |