[El-errata] ELSA-2026-55787 Moderate: Oracle Linux 9 java-21-openjdk security update

Fri Aug 21 15:01:16 UTC 2026

Oracle Linux Security Advisory ELSA-2026-55787

http://linux.oracle.com/errata/ELSA-2026-55787.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
java-21-openjdk-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-demo-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-demo-fastdebug-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-demo-slowdebug-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-devel-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-devel-fastdebug-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-devel-slowdebug-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-fastdebug-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-headless-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-headless-fastdebug-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-headless-slowdebug-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-javadoc-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-javadoc-zip-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-jmods-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-jmods-fastdebug-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-jmods-slowdebug-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-slowdebug-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-src-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-src-fastdebug-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-src-slowdebug-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-static-libs-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-static-libs-fastdebug-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm
java-21-openjdk-static-libs-slowdebug-21.0.12.1.1-1.2.0.1.el9.x86_64.rpm

aarch64:
java-21-openjdk-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-demo-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-demo-fastdebug-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-demo-slowdebug-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-devel-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-devel-fastdebug-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-devel-slowdebug-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-fastdebug-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-headless-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-headless-fastdebug-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-headless-slowdebug-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-javadoc-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-javadoc-zip-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-jmods-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-jmods-fastdebug-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-jmods-slowdebug-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-slowdebug-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-src-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-src-fastdebug-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-src-slowdebug-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-static-libs-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-static-libs-fastdebug-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm
java-21-openjdk-static-libs-slowdebug-21.0.12.1.1-1.2.0.1.el9.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/java-21-openjdk-21.0.12.1.1-1.2.0.1.el9.src.rpm

Related CVEs:

CVE-2026-60589
CVE-2026-61308
CVE-2026-70907

Description of changes:

[1:21.0.12.1.1-1.2.0.1]
- Add Oracle vendor bug URL [Orabug: 34340155]

[1:21.0.12.1.1-1.2]
- Bump release for PQC build
- Related: RHEL-235625

[1:21.0.12.1.1-1.1]
- Update to jdk-21.0.12.1+1 (GA)
- Update release notes to 21.0.12.1+1
- Sync the copy of the portable specfile with the latest update
- ** This tarball is embargoed until 2026-08-18 @ 1pm PT. **
- Resolves: RHEL-235625

[1:21.0.12.0.8-2.1]
- Add CVEs to NEWS file
- Update to tarball with final changeset ID
- Sync the copy of the portable specfile with the latest update
- Related: RHEL-188866

[1:21.0.12.0.8-1.2]
- Bump release for PQC build
- Related: RHEL-212332
- Related: RHEL-212334
- Related: RHEL-212336
- Related: RHEL-151193
- Related: RHEL-212341
- Related: RHEL-188866
- Related: RHEL-212345
- Related: RHEL-212347
- Related: RHEL-151167
- Related: RHEL-212348
- Related: RHEL-212349

[1:21.0.12.0.8-1.1]
- Update to jdk-21.0.12+8 (GA)
- Update release notes to 21.0.12+8
- Bump freetype version to 2.14.3 following JDK-8385390
- Bump giflib version to 6.1.3 following JDK-8384902
- Bump HarfBuzz version to 14.2.0 following JDK-8385490
- Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354
- Bump libpng version to 1.6.58 following JDK-8384495
- Update tagging scripts to include signature checks and correctly handle gating
- Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3.
- Add gating scripts to simplify obtaining results and waiving issues
- Cleanup tagging and gating scripts to appease shellcheck:
- * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg.
- * scripts/builds/check_signatures.sh: Quote variable usage.
- * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage.
- * scripts/builds/waive_leapp_issue.sh: Likewise.
- * scripts/builds/waive_rpminspect.sh: Likewise.
- * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable.
- * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage.
- Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file
- Specify portablerelease and rpmrelease (always 0 for portables) in the Release field
- Obsolete old RHEL releases (9.7.0-z, 10.1-z)
- Make zone string debug output optional in TestTranslations
- Change javadoc-zip to just own the top-level directory, not include the entire subtree
- Sync the copy of the portable specfile with the latest update
- ** This tarball is embargoed until 2026-07-21 @ 1pm PT. **
- Resolves: RHEL-212332
- Resolves: RHEL-212334
- Resolves: RHEL-212336
- Resolves: RHEL-151193
- Resolves: RHEL-212341
- Resolves: RHEL-188866
- Resolves: RHEL-212345
- Resolves: RHEL-212347
- Related: RHEL-212349

[1:21.0.11.0.10-1.3]
- Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm
- See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1
- Do not overwrite slowdebug __provides_exclude_from and __requires_exclude_from regexps
- Make headless own /usr/share/doc/java-1.8.0-openjdk
- Make javadoc-zip own /usr/share/javadoc/java-1.8.0-openjdk
- Resolves: RHEL-151167
- Resolves: RHEL-212348
- Resolves: RHEL-212349