Skip to content
audiotale.net
Sign in
NewsNews

OpenJDK October 2026 advisory: 47 Java CVEs and 6 JavaFX, Corretto 25.0.5

The 20 October 2026 OpenJDK advisory fixes 47 OpenJDK and 6 OpenJFX CVEs, none above CVSS 7.5; here is who is affected and how to update.

audiotale.net team

· 6 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. The numbers
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

OpenJDK's October 2026 quarterly security advisory, published on 20 October 2026, lists 47 fixed vulnerabilities in the Java runtime and another six in OpenJFX, the JavaFX toolkit. None is rated above CVSS 7.5, and the top-scoring OpenJDK item, CVE-2026-91415 in the 2D graphics library, scores 7.0. Amazon followed on 22 October with new Corretto builds for every supported line. Because the advisory recommends upgrading "as soon as possible" and Java sits underneath so many servers, build tools and desktop apps, here is what is in the update, who needs it, and how to check what you run.

Key points

  • The OpenJDK advisory dated 20 October 2026 lists 47 OpenJDK CVEs and 6 OpenJFX CVEs; defense-in-depth fixes are not assigned CVEs.
  • The highest score is 7.5, for OpenJFX's CVE-2026-43660 in the web component; the highest for OpenJDK itself is 7.0, for CVE-2026-91415 in client-libs/2d.
  • Affected versions are 26.0.2.1, 25.0.4.1, 21.0.12.1, 17.0.20.1, 11.0.32.1 and 8u504 "and earlier", per the advisory.
  • Amazon released Corretto 27.0.1.0.10, 25.0.5.0.9, 21.0.13.0.10, 17.0.21.0.10, 11.0.33.0.9 and 8u512 on 22 October 2026.
  • Japan's IPA lists Oracle's own October 2026 advisory for Java SE 27, 26.0.2, 25.0.4.1, 21.0.12.1, 17.0.20.1, 11.0.32.1 and 8 Update 503, and urges updating quickly.

What to do

  1. Find out what you run. Run java -version on each server, CI runner and developer machine, and in containers, docker run --rm <image> java -version. Compare the version with the affected list above.
  2. Update to the vendor's October 2026 build. If you use Amazon Corretto, take the builds above from the Corretto downloads page or your package repository. Other distributions (Oracle JDK, Temurin, Red Hat, Ubuntu, Azul and others) publish their own builds; use the one released after 20 October 2026. We have not confirmed the exact fixed version numbers for distributions other than Corretto.
  3. Rebuild container images. A base image pinned to an older tag keeps the old runtime until you rebuild it.
  4. Check bundled runtimes. Applications that ship their own JRE, such as some IDEs, build tools and desktop software, need the vendor's update, not yours.
  5. Prioritise exposed services. The advisory's matrix is the place to see whether a given CVE can be reached over the network in your configuration; we could not confirm what the compact attack-vector codes mean, so read the CVE records before ranking your own risk.

There is no workaround listed in the sources we read. If you cannot patch at once, the advisory gives no mitigation, so treat updating as the only fix.

What happened

OpenJDK's vulnerability group published its advisory on 20 October 2026. It states the vulnerabilities "were fixed in this release" and that issues which only strengthen defences are not assigned CVEs. It lists 47 OpenJDK CVEs and 6 OpenJFX CVEs, with CVSS 3.1 scores and the component each touches. The advisory does not itself name the fixed version numbers; it gives the affected versions as 26.0.2.1, 25.0.4.1, 21.0.12.1, 17.0.20.1, 11.0.32.1 and 8u504 and earlier.

On 22 October 2026 Amazon announced its quarterly Corretto update, with builds 27.0.1.0.10, 25.0.5.0.9, 21.0.13.0.10, 17.0.21.0.10, 11.0.33.0.9 and 8u512. Amazon describes them as quarterly security and critical updates for its long-term-supported OpenJDK builds. The announcement lists no CVE identifiers, so the link between each Corretto build and individual CVEs has to be taken from the OpenJDK advisory and release notes. The build numbers (for example 25.0.5 after 25.0.4.1) fit the usual pattern of a quarterly update following the previous one, but that is our reading, not something the advisory states.

Japan's Information-technology Promotion Agency (IPA) published an alert on 21 October 2026 pointing to Oracle's own October 2026 Critical Patch Update, whose Java SE risk matrix covers Java SE 27, 26.0.2, 25.0.4.1, 21.0.12.1, 17.0.20.1, 11.0.32.1 and 8 Update 503. IPA says exploitation could crash applications or let an attacker take control of the computer, and urges applying the update as soon as possible. IPA does not state a CVE count or a top score. We could not open Oracle's advisory page (it returned an access error), so we have not checked Oracle's numbers directly.

Note the small differences between lists. The OpenJDK advisory names 8u504 as affected; IPA names Oracle's Java 8 Update 503. The OpenJDK list does not mention Java 27, while IPA's list of Oracle products does, and Amazon has shipped a Corretto 27 build. These come from different organisations' products and wording, so check your own vendor's notes for your exact version.

Background

Java ships security updates on a fixed quarterly cycle, in January, April, July and October. OpenJDK publishes advisories, and downstream vendors build and release their own binaries from the same source. That is why one October advisory produces a string of vendor announcements over the following days, and why the version numbers differ from vendor to vendor.

Our earlier coverage of Java this month dealt with a separate matter, the eMudhra fixes tracked as CVE-2026-114820 and CVE-2026-91403. If you manage trust stores, our explainer on how Java decides which certificates to trust helps with the certificate side of upgrades.

The numbers

The 47 OpenJDK CVEs are mostly medium or low in CVSS terms. Counting the scores in the advisory table:

OpenJDK CVEs fixed in October 2026, by CVSS 3.1 score bandCVEs
OpenJDK CVEs fixed in October 2026, by CVSS 3.1 score band (CVEs)
CVEs
5.0 to 5.920
3.0 to 3.911
6.0 to 6.97
4.0 to 4.97
7.0 and above1
Below 3.01

Source: OpenJDK vulnerability advisory, 20 October 2026

The 5.0–5.9 band holds the most: 20 CVEs (six at 5.9, one at 5.4 and thirteen at 5.3). The 3.0–3.9 band has 11 (nine at 3.7, one at 3.6, one at 3.1), the 6.0–6.9 band has 7 (one at 6.8 and six at 6.5), the 4.0–4.9 band has 7 and only CVE-2026-91415 reaches 7.0. One, CVE-2026-91335 in java.awt, scores 2.6.

By component, the networking library is the busiest area: the advisory lists CVEs in core-libs/java.net several times, followed by the security libraries (java.security, javax.net.ssl and the GSS implementation, org.ietf.jgss), the 2D graphics libraries, HotSpot's compiler and the XML (JAXP) code. OpenJFX's six CVEs range from 7.5 (CVE-2026-43660, javafx/web) down to 3.1 (two in javafx/graphics).

What it means

For most teams this is a routine, scheduled patch rather than an emergency: no OpenJDK CVE in the advisory scores above 7.0 and none reaches the "critical" band. That does not make it optional. Medium-severity flaws in networking, TLS and XML parsing code are the ones that get chained or become exploitable depending on how an application uses them, and CVSS ratings describe the library in the abstract rather than your deployment.

Server operators and platform teams carry most of the work: runtimes in container images, CI agents and application servers are the typical stragglers. Desktop users of JavaFX applications should note that the highest score in the whole advisory is the OpenJFX web component, a reminder that embedded browser components are patched on the Java schedule, not the browser's.

Teams that standardise on a single vendor's distribution gain from the quarterly rhythm: Corretto moved all six supported lines in one announcement. Teams mixing distributions need to check each vendor separately.

What we don't know yet

  • The upstream fixed version numbers for each line. The advisory lists affected versions only; Amazon's builds are the ones we can name.
  • Which CVEs Amazon's builds address individually; its announcement lists none.
  • Oracle's own count and top score; we could not open its advisory.
  • Whether any of these CVEs are being exploited. None of the sources we read says so.
  • What the advisory's abbreviated attack-vector codes mean for each CVE; the page does not define them.

What to watch next

Watch your own distribution's advisory for the October 2026 build (Oracle, Red Hat, Ubuntu, SUSE, Azul, Eclipse Temurin), and the CVE records for the scoring details. The next quarterly cycle is January 2027.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next