What is RHSA-2026:0933?

RHSA-2026:0933 is a security advisory published by Red Hat Product Security with High severity. Red Hat Security Advisory: java-25-openjdk security update

Which CVE IDs does RHSA-2026:0933 cover?

RHSA-2026:0933 covers the following CVE IDs: CVE-2025-64720, CVE-2025-65018, CVE-2026-21925, CVE-2026-21933, CVE-2026-21945. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of RHSA-2026:0933?

RHSA-2026:0933 has a CVSS v3 base score of 7.5, published by Red Hat Product Security.

Which products are affected by RHSA-2026:0933?

RHSA-2026:0933 affects 200 products, including: Red Hat Enterprise Linux AppStream (v. 10); Red Hat Enterprise Linux AppStream (v. 9); Red Hat Enterprise Linux CodeReady Linux Builder (v. 10); Red Hat Enterprise Linux CodeReady Linux Builder (v. 9); java-25-openjdk-1:25.0.2.0.10-1.el10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10); and others — see the full list on the advisory page.

RHSA-2026:0933HighCVSS 7.5

Red Hat Security Advisory: java-25-openjdk security update

Vendor

Red Hat Product Security

Published

January 26, 2026

Last Modified

July 30, 2026

🔗 CVE IDs covered (5)

CVE-2025-64720 →CVE-2025-65018 →CVE-2026-21925 →CVE-2026-21933 →CVE-2026-21945 →

📋 Description

CVE-2025-64720 — libpng: LIBPNG buffer overflow CVE-2025-65018 — libpng: LIBPNG heap buffer overflow CVE-2026-21925 — openjdk: Improve JMX connections (Oracle CPU 2026-01) CVE-2026-21933 — openjdk: Improve HttpServer Request handling (Oracle CPU 2026-01) CVE-2026-21945 — openjdk: Enhance Certificate Checking (Oracle CPU 2026-01)

🎯 Affected products200

Red Hat Enterprise Linux AppStream (v. 10)
Red Hat Enterprise Linux AppStream (v. 9)
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
java-25-openjdk-1:25.0.2.0.10-1.el10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
java-25-openjdk-1:25.0.2.0.10-1.el10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
java-25-openjdk-1:25.0.2.0.10-1.el10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
java-25-openjdk-1:25.0.2.0.10-1.el10.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
java-25-openjdk-1:25.0.2.0.10-1.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
java-25-openjdk-1:25.0.2.0.10-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
java-25-openjdk-1:25.0.2.0.10-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
java-25-openjdk-1:25.0.2.0.10-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
java-25-openjdk-1:25.0.2.0.10-1.el9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
java-25-openjdk-1:25.0.2.0.10-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
java-25-openjdk-crypto-adapter-1:25.0.2.0.10-1.el10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
java-25-openjdk-crypto-adapter-1:25.0.2.0.10-1.el10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
java-25-openjdk-crypto-adapter-1:25.0.2.0.10-1.el10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
java-25-openjdk-crypto-adapter-1:25.0.2.0.10-1.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
java-25-openjdk-crypto-adapter-1:25.0.2.0.10-1.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
java-25-openjdk-crypto-adapter-1:25.0.2.0.10-1.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
java-25-openjdk-crypto-adapter-1:25.0.2.0.10-1.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
java-25-openjdk-crypto-adapter-1:25.0.2.0.10-1.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
java-25-openjdk-crypto-adapter-debuginfo-1:25.0.2.0.10-1.el10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
java-25-openjdk-crypto-adapter-debuginfo-1:25.0.2.0.10-1.el10.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
java-25-openjdk-crypto-adapter-debuginfo-1:25.0.2.0.10-1.el10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
java-25-openjdk-crypto-adapter-debuginfo-1:25.0.2.0.10-1.el10.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
java-25-openjdk-crypto-adapter-debuginfo-1:25.0.2.0.10-1.el10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
java-25-openjdk-crypto-adapter-debuginfo-1:25.0.2.0.10-1.el10.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
java-25-openjdk-crypto-adapter-debuginfo-1:25.0.2.0.10-1.el10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
java-25-openjdk-crypto-adapter-debuginfo-1:25.0.2.0.10-1.el10.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
+170 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 CVE IDs covered (5)

📋 Description

🎯 Affected products200

✅ Remediation

🔗 References (3)