Ubuntu USN-8341-1: OpenJDK 26 JAXP/Networking/JSSE/JGSS Vulnerabilities Patch

Vulnerability Overview Vulnerability ID: USN-8341-1 Release Date: May 28, 2026 Vulnerability Description: - Thomas Beckers discovered that the JAXP component of OpenJDK 26 failed to correctly validate certain APIs, allowing remote unauthenticated attackers to gain unauthorized access to sensitive information. (CVE-2026-22018) - The Networking component of OpenJDK 26 was found to fail to correctly validate certain APIs, allowing remote unauthenticated attackers to cause a denial of service. (CVE-2026-34282) - The JSSE component of OpenJDK 26 was found to fail to correctly validate certain APIs, allowing remote unauthenticated attackers to cause a denial of service. (CVE-2026-22021) - The JGSS component of OpenJDK 26 was found to fail to correctly validate certain APIs, allowing remote attackers to cause a denial of service. (CVE-2026-22016) Affected Versions Affected Versions: - Ubuntu 26.04 LTS (resolute) - Ubuntu 25.10 (questing) Remediation Update Notes: - This update incorporates a new upstream version, including additional bug fixes. After performing a standard system update, all running Java applications must be restarted to apply all necessary changes. - Update the system to the following package versions: - Ubuntu 26.04 LTS (resolute): - openjdk-26-jdk – 26.0.1+8-2~26.04.2 - openjdk-26-jdk-headless – 26.0.1+8-2~26.04.2 - openjdk-26-jre – 26.0.1+8-2~26.04.2 - openjdk-26-jre-headless – 26.0.1+8-2~26.04.2 - openjdk-26-jre-zero – 26.0.1+8-2~26.04.2 - Ubuntu 25.10 (questing): - openjdk-26-jdk – 26.0.1+8-2~25.10.2 - openjdk-26-jdk-headless – 26.0.1+8-2~25.10.2 - openjdk-26-jre – 26.0.1+8-2~25.10.2 - openjdk-26-jre-headless – 26.0.1+8-2~25.10.2 - openjdk-26-jre-zero – 26.0.1+8-2~25.10.2 References CVE-2026-34282 CVE-2026-34268 CVE-2026-23865 CVE-2026-22021 CVE-2026-22018 CVE-2026-22016 CVE-2026-22013 CVE-2026-22008 CVE-2026-22007 Related Notices USN-8339-1 USN-8334-1 USN-8333-1 USN-8332-1 USN-8331-1 USN-8330-1 USN-8328-1 USN-8327-1 USN-8086-1 Additional Information Reducing Security Exposure: - Ubuntu Pro offers ten years of security coverage for more than 25,000 packages in the Main and Universe repositories, free for up to five machines. - Get Ubuntu Pro Contact For further questions, please contact the team members. --- Note: POC code or exploitation code is not included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

Ubuntu USN-8341-1: OpenJDK 26 JAXP/Networking/JSSE/JGSS Vulnerabilities Patch

More from this source