Security1 hOctober 23, 2026, 04:00

Out-of-band Java patch fixes critical JSSE flaw CVE-2026-91403

On October 21, 2026, OpenJDK disclosed CVE-2026-91403 in JSSE, Java's TLS implementation, rated CVSS 9.1. The flaw affects even the October patch releases (8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1) and GraalVM, stemming from eight compromised eMudhra intermediate certificates with weak private keys.

DEV Community

Open source

Out-of-band Java patch fixes critical JSSE flaw CVE-2026-91403

CVSS 9.1: remotely exploitable without authentication at low complexity
Affects OpenJDK 8, 11, 17, 21, 25, 27 and GraalVM
October patch fixed 55 Java SE flaws, 49 remotely exploitable
Java 26 no longer patched; users must move to 25 LTS or 27

#Java#OpenJDK#Oracle#EMudhra

OpenJDK bans AI-generated code but allows AI-assisted reading

Software

Oracle JDK 21 goes paid on October 20

Security

Azul Patches 53 OpenJDK Vulnerabilities

Software

Out-of-band Java patch fixes critical JSSE flaw CVE-2026-91403

OpenJDK bans AI-generated code but allows AI-assisted reading

Oracle JDK 21 goes paid on October 20

Azul Patches 53 OpenJDK Vulnerabilities

Java roundup: JDK 28 JEPs, Azul Payara release, 38 Apache Camel CVEs