openjdk: Enhance Jar file processing (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The processImpl method in SignatureFileVerifier exhibits On^2 time complexity when verifying JAR files where different entries have different signer combinations, potentially leading to DoS...

openjdk: Improve DTLS handshaking (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The DTLS implementation is open to two different DoS attacks...

openjdk: Enhance Jar handling (Oracle CPU 2026-07)

A flaw was found in OpenJDK. There exists a potential existential forgery vulnerability in CMS and protocols which use CMS. In Java, CMS is used to sign JAR files...

CVE-2026-60007

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated...

CVE-2026-60007

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated...

CVE-2026-60007

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated...

CVE-2026-60007

CVE-2026-60007 affects Eclipse Milo versions 0.6.0 through 1.1.4, where username-token processing reveals distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures. This enables a network-accessible, on-path attacker who captures a victim’s Basic128Rsa15-encrypt...

CVE-2026-60007

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated...

EUVD-2026-52660

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's Basic128Rsa15-encrypted username token to use repeated unauthenticated...

cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

Summarypkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported theoutcome of decrypting a RecipientInfo's encryptedKey in severaldistinguishable ways, one of which disclosed the exact length recovered from theRSA operation. The same distinction was also observable by timing. Anapplicatio...

PYSEC-2026-3552 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

Summary pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which disclosed the exact length recovered from the RSA operation. The same distinction was also observable by timing. An...

thunderbird security update

140.13.0-1.0.1 - Fix prefs for new nss Orabug: 37079820 - Add Oracle prefs file 140.13.0 - Add OpenELA debranding 140.13.0-1 - Update to 140.13.0 ESR...

thunderbird security update

140.13.0-1.0.1 - Fix prefs for new nss Orabug: 37079813 - Add Oracle prefs 140.13.0 - Add OpenELA debranding 140.13.0-1 - Update to 140.13.0 ESR...

Amazon Linux 2023 : java-25-amazon-corretto, java-25-amazon-corretto-devel, java-25-amazon-corretto-headless (ALAS2023-2026-2020)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2020 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java S...

glibc security update

2.34-274.0.1 - Forward-port Oracle patches for ol9-u8 Reviewed-by: Jose E. Marchesi Reviewed-by: David Faust Oracle history: June-30-2026 Cupertino Miranda - 2.34-272.0.1 - Forward-port Oracle patches for ol9-u8 Reviewed-by: Jose E. Marchesi Reviewed-by: David Faust June-5-2026 Cupertino Miranda ...

Important: java-11-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11...

Important: java-25-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11...

Important: java-17-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11...

Important: java-1.8.0-amazon-corretto

Issue Overview: Vulnerability in Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit...

Important: java-1.8.0-openjdk

Issue Overview: Vulnerability in Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit...