USN-8695-1

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-8695-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8695-1.json
JSON Data
https://api.osv.dev/v1/vulns/USN-8695-1
Upstream
Related
Published
2026-08-31T10:43:21Z
Modified
2026-08-31T22:26:26.813816620Z
Summary
openjdk-25-crac vulnerabilities
Details

It was discovered that the JSSE component of CRaC JDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-46968)

It was discovered that the JSSE component of CRaC JDK 25 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-46917)

It was discovered that the ImageIO component of CRaC JDK 25 did not correctly authorize users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-47010)

It was discovered that the 2D component of CRaC JDK 25 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-47021, CVE-2026-47059)

It was discovered that the Libraries component of CRaC JDK 25 did not correctly authorize users. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-47027)

It was discovered that the Security component of CRaC JDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-60147)

It was discovered that the Libraries component of CRaC JDK 25 did not correctly authenticate users. A remote attacker could possibly use this issue to read or modify sensitive data. (CVE-2026-47063)

It was discovered that the 2D (Little CMS) component of CRaC JDK 25 did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-41254)

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information: https://openjdk.org/groups/vulnerability/advisories/2026-07-21

References

Affected packages

Ubuntu:26.04:LTS / openjdk-25-crac

Package

Name
openjdk-25-crac
Purl
pkg:deb/ubuntu/openjdk-25-crac?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
25.0.4+7-0ubuntu1~26.04

Affected versions

Other
25+36-0ubuntu1
25.*
25.0.1+8-0ubuntu1
25.0.2+10-0ubuntu1
25.0.3+9-0ubuntu1~26.04.1

Ecosystem specific 

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "25.0.4+7-0ubuntu1~26.04",
            "binary_name": "openjdk-25-crac-demo"
        },
        {
            "binary_version": "25.0.4+7-0ubuntu1~26.04",
            "binary_name": "openjdk-25-crac-jdk"
        },
        {
            "binary_version": "25.0.4+7-0ubuntu1~26.04",
            "binary_name": "openjdk-25-crac-jdk-headless"
        },
        {
            "binary_version": "25.0.4+7-0ubuntu1~26.04",
            "binary_name": "openjdk-25-crac-jre"
        },
        {
            "binary_version": "25.0.4+7-0ubuntu1~26.04",
            "binary_name": "openjdk-25-crac-jre-headless"
        },
        {
            "binary_version": "25.0.4+7-0ubuntu1~26.04",
            "binary_name": "openjdk-25-crac-jre-zero"
        },
        {
            "binary_version": "25.0.4+7-0ubuntu1~26.04",
            "binary_name": "openjdk-25-crac-source"
        },
        {
            "binary_version": "25.0.4+7-0ubuntu1~26.04",
            "binary_name": "openjdk-25-crac-testsupport"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8695-1.json"
cves_map 
{
    "ecosystem": "Ubuntu:26.04:LTS",
    "cves": []
}