openjdk: Enhance String handling (Oracle CPU 2025-10)

🗓️ 22 Oct 2025 20:28:30Reported by RedHatType

redhat🔗 access.redhat.com👁 16 Views

Oracle Java SE and GraalVM expose an unauthenticated API vulnerability that could enable data modification.

Reporter	Title	Published	Views	Family All 176
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for February 2025.	13 Mar 202616:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (May 2026)	14 May 202601:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates	26 Nov 202516:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions.	11 Dec 202515:30	–	ibm
IBM Security Bulletins	Security Bulletin: File permission modification, improper access control, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service	16 Feb 202615:12	–	ibm
Tenable Nessus	Amazon Linux 2023 : java-25-amazon-corretto, java-25-amazon-corretto-devel, java-25-amazon-corretto-headless (ALAS2023-2025-1240)	28 Oct 202500:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : java-21-amazon-corretto, java-21-amazon-corretto-devel, java-21-amazon-corretto-headless (ALAS2023-2025-1241)	28 Oct 202500:00	–	nessus
Tenable Nessus	AlmaLinux 10 : java-21-openjdk (ALSA-2025:18824)	30 Oct 202500:00	–	nessus
Tenable Nessus	Azul Zulu Java Multiple Vulnerabilities (2025-10-21)	21 Oct 202500:00	–	nessus
Tenable Nessus	Rocky Linux 10.1 [CIQ] Security Update: java-25-openjdk / java-25-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_21485)	1 Oct 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	aarch64	java-21-openjdk	1:21.0.9.0.10-1.el8	java-21-openjdk-1:21.0.9.0.10-1.el8.aarch64.rpm
Red Hat Enterprise Linux	8	ppc64le	java-21-openjdk	1:21.0.9.0.10-1.el8	java-21-openjdk-1:21.0.9.0.10-1.el8.ppc64le.rpm
Red Hat Enterprise Linux	8	s390x	java-21-openjdk	1:21.0.9.0.10-1.el8	java-21-openjdk-1:21.0.9.0.10-1.el8.s390x.rpm
Red Hat Enterprise Linux	8	x86_64	java-21-openjdk	1:21.0.9.0.10-1.el8	java-21-openjdk-1:21.0.9.0.10-1.el8.x86_64.rpm
Red Hat Enterprise Linux	9	aarch64	java-21-openjdk	1:21.0.9.0.10-1.el9	java-21-openjdk-1:21.0.9.0.10-1.el9.aarch64.rpm
Red Hat Enterprise Linux	9	ppc64le	java-21-openjdk	1:21.0.9.0.10-1.el9	java-21-openjdk-1:21.0.9.0.10-1.el9.ppc64le.rpm
Red Hat Enterprise Linux	9	s390x	java-21-openjdk	1:21.0.9.0.10-1.el9	java-21-openjdk-1:21.0.9.0.10-1.el9.s390x.rpm
Red Hat Enterprise Linux	9	x86_64	java-21-openjdk	1:21.0.9.0.10-1.el9	java-21-openjdk-1:21.0.9.0.10-1.el9.x86_64.rpm
Red Hat Enterprise Linux	10	aarch64	java-21-openjdk	1:21.0.9.0.10-1.el10	java-21-openjdk-1:21.0.9.0.10-1.el10.aarch64.rpm
Red Hat Enterprise Linux	10	ppc64le	java-21-openjdk	1:21.0.9.0.10-1.el10	java-21-openjdk-1:21.0.9.0.10-1.el10.ppc64le.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2025-61748
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-61748
cve	www.cve.org/CVERecord
oracle	www.oracle.com/security-alerts/cpuoct2025.html

18 Sep 2026 11:30Current

7.2High risk

Vulners AI Score7.2

CVSS 3.13.7

EPSS0.00389

SSVC

java standard edition graalvm for java graalvm enterprise edition unauthenticated access remote vulnerability data modification sandboxed java deployment web service access