{"schema_version":"1.7.2","id":"OESA-2026-3984","modified":"2026-09-20T13:23:50Z","published":"2026-09-20T13:23:50Z","upstream":["CVE-2026-60147"],"summary":"openjdk-17 security update","details":"The OpenJDK runtime environment.\r\n\r\nSecurity Fix(es):\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and  21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).(CVE-2026-60147)","affected":[{"package":{"ecosystem":"openEuler:24.03-LTS-SP4","name":"openjdk-17","purl":"pkg:rpm/openEuler/openjdk-17&distro=openEuler-24.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"java-17-openjdk-17.0.20.8-4.oe2403sp4"}]}],"ecosystem_specific":{"aarch64":["java-17-openjdk-17.0.20.8-4.oe2403sp4.aarch64.rpm","java-17-openjdk-debuginfo-17.0.20.8-4.oe2403sp4.aarch64.rpm","java-17-openjdk-debugsource-17.0.20.8-4.oe2403sp4.aarch64.rpm","java-17-openjdk-demo-17.0.20.8-4.oe2403sp4.aarch64.rpm","java-17-openjdk-demo-slowdebug-17.0.20.8-4.oe2403sp4.aarch64.rpm","java-17-openjdk-devel-17.0.20.8-4.oe2403sp4.aarch64.rpm","java-17-openjdk-devel-slowdebug-17.0.20.8-4.oe2403sp4.aarch64.rpm","java-17-openjdk-headless-17.0.20.8-4.oe2403sp4.aarch64.rpm","java-17-openjdk-headless-slowdebug-17.0.20.8-4.oe2403sp4.aarch64.rpm","java-17-openjdk-javadoc-17.0.20.8-4.oe2403sp4.aarch64.rpm","java-17-openjdk-javadoc-zip-17.0.20.8-4.oe2403sp4.aarch64.rpm","java-17-openjdk-jmods-17.0.20.8-4.oe2403sp4.aarch64.rpm","java-17-openjdk-jmods-slowdebug-17.0.20.8-4.oe2403sp4.aarch64.rpm","java-17-openjdk-slowdebug-17.0.20.8-4.oe2403sp4.aarch64.rpm","java-17-openjdk-src-17.0.20.8-4.oe2403sp4.aarch64.rpm","java-17-openjdk-src-slowdebug-17.0.20.8-4.oe2403sp4.aarch64.rpm"],"src":["java-17-openjdk-17.0.20.8-4.oe2403sp4.src.rpm"],"x86_64":["java-17-openjdk-17.0.20.8-4.oe2403sp4.x86_64.rpm","java-17-openjdk-debuginfo-17.0.20.8-4.oe2403sp4.x86_64.rpm","java-17-openjdk-debugsource-17.0.20.8-4.oe2403sp4.x86_64.rpm","java-17-openjdk-demo-17.0.20.8-4.oe2403sp4.x86_64.rpm","java-17-openjdk-demo-slowdebug-17.0.20.8-4.oe2403sp4.x86_64.rpm","java-17-openjdk-devel-17.0.20.8-4.oe2403sp4.x86_64.rpm","java-17-openjdk-devel-slowdebug-17.0.20.8-4.oe2403sp4.x86_64.rpm","java-17-openjdk-headless-17.0.20.8-4.oe2403sp4.x86_64.rpm","java-17-openjdk-headless-slowdebug-17.0.20.8-4.oe2403sp4.x86_64.rpm","java-17-openjdk-javadoc-17.0.20.8-4.oe2403sp4.x86_64.rpm","java-17-openjdk-javadoc-zip-17.0.20.8-4.oe2403sp4.x86_64.rpm","java-17-openjdk-jmods-17.0.20.8-4.oe2403sp4.x86_64.rpm","java-17-openjdk-jmods-slowdebug-17.0.20.8-4.oe2403sp4.x86_64.rpm","java-17-openjdk-slowdebug-17.0.20.8-4.oe2403sp4.x86_64.rpm","java-17-openjdk-src-17.0.20.8-4.oe2403sp4.x86_64.rpm","java-17-openjdk-src-slowdebug-17.0.20.8-4.oe2403sp4.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:20.03-LTS-SP4","name":"openjdk-17","purl":"pkg:rpm/openEuler/openjdk-17&distro=openEuler-20.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"java-17-openjdk-17.0.20.8-4.oe2003sp4"}]}],"ecosystem_specific":{"aarch64":["java-17-openjdk-17.0.20.8-4.oe2003sp4.aarch64.rpm","java-17-openjdk-debuginfo-17.0.20.8-4.oe2003sp4.aarch64.rpm","java-17-openjdk-debugsource-17.0.20.8-4.oe2003sp4.aarch64.rpm","java-17-openjdk-demo-17.0.20.8-4.oe2003sp4.aarch64.rpm","java-17-openjdk-demo-slowdebug-17.0.20.8-4.oe2003sp4.aarch64.rpm","java-17-openjdk-devel-17.0.20.8-4.oe2003sp4.aarch64.rpm","java-17-openjdk-devel-slowdebug-17.0.20.8-4.oe2003sp4.aarch64.rpm","java-17-openjdk-headless-17.0.20.8-4.oe2003sp4.aarch64.rpm","java-17-openjdk-headless-slowdebug-17.0.20.8-4.oe2003sp4.aarch64.rpm","java-17-openjdk-javadoc-17.0.20.8-4.oe2003sp4.aarch64.rpm","java-17-openjdk-javadoc-zip-17.0.20.8-4.oe2003sp4.aarch64.rpm","java-17-openjdk-jmods-17.0.20.8-4.oe2003sp4.aarch64.rpm","java-17-openjdk-jmods-slowdebug-17.0.20.8-4.oe2003sp4.aarch64.rpm","java-17-openjdk-slowdebug-17.0.20.8-4.oe2003sp4.aarch64.rpm","java-17-openjdk-src-17.0.20.8-4.oe2003sp4.aarch64.rpm","java-17-openjdk-src-slowdebug-17.0.20.8-4.oe2003sp4.aarch64.rpm"],"src":["java-17-openjdk-17.0.20.8-4.oe2003sp4.src.rpm"],"x86_64":["java-17-openjdk-17.0.20.8-4.oe2003sp4.x86_64.rpm","java-17-openjdk-debuginfo-17.0.20.8-4.oe2003sp4.x86_64.rpm","java-17-openjdk-debugsource-17.0.20.8-4.oe2003sp4.x86_64.rpm","java-17-openjdk-demo-17.0.20.8-4.oe2003sp4.x86_64.rpm","java-17-openjdk-demo-slowdebug-17.0.20.8-4.oe2003sp4.x86_64.rpm","java-17-openjdk-devel-17.0.20.8-4.oe2003sp4.x86_64.rpm","java-17-openjdk-devel-slowdebug-17.0.20.8-4.oe2003sp4.x86_64.rpm","java-17-openjdk-headless-17.0.20.8-4.oe2003sp4.x86_64.rpm","java-17-openjdk-headless-slowdebug-17.0.20.8-4.oe2003sp4.x86_64.rpm","java-17-openjdk-javadoc-17.0.20.8-4.oe2003sp4.x86_64.rpm","java-17-openjdk-javadoc-zip-17.0.20.8-4.oe2003sp4.x86_64.rpm","java-17-openjdk-jmods-17.0.20.8-4.oe2003sp4.x86_64.rpm","java-17-openjdk-jmods-slowdebug-17.0.20.8-4.oe2003sp4.x86_64.rpm","java-17-openjdk-slowdebug-17.0.20.8-4.oe2003sp4.x86_64.rpm","java-17-openjdk-src-17.0.20.8-4.oe2003sp4.x86_64.rpm","java-17-openjdk-src-slowdebug-17.0.20.8-4.oe2003sp4.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:22.03-LTS-SP4","name":"openjdk-17","purl":"pkg:rpm/openEuler/openjdk-17&distro=openEuler-22.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"java-17-openjdk-17.0.20.8-4.oe2203sp4"}]}],"ecosystem_specific":{"aarch64":["java-17-openjdk-17.0.20.8-4.oe2203sp4.aarch64.rpm","java-17-openjdk-debuginfo-17.0.20.8-4.oe2203sp4.aarch64.rpm","java-17-openjdk-debugsource-17.0.20.8-4.oe2203sp4.aarch64.rpm","java-17-openjdk-demo-17.0.20.8-4.oe2203sp4.aarch64.rpm","java-17-openjdk-demo-slowdebug-17.0.20.8-4.oe2203sp4.aarch64.rpm","java-17-openjdk-devel-17.0.20.8-4.oe2203sp4.aarch64.rpm","java-17-openjdk-devel-slowdebug-17.0.20.8-4.oe2203sp4.aarch64.rpm","java-17-openjdk-headless-17.0.20.8-4.oe2203sp4.aarch64.rpm","java-17-openjdk-headless-slowdebug-17.0.20.8-4.oe2203sp4.aarch64.rpm","java-17-openjdk-javadoc-17.0.20.8-4.oe2203sp4.aarch64.rpm","java-17-openjdk-javadoc-zip-17.0.20.8-4.oe2203sp4.aarch64.rpm","java-17-openjdk-jmods-17.0.20.8-4.oe2203sp4.aarch64.rpm","java-17-openjdk-jmods-slowdebug-17.0.20.8-4.oe2203sp4.aarch64.rpm","java-17-openjdk-slowdebug-17.0.20.8-4.oe2203sp4.aarch64.rpm","java-17-openjdk-src-17.0.20.8-4.oe2203sp4.aarch64.rpm","java-17-openjdk-src-slowdebug-17.0.20.8-4.oe2203sp4.aarch64.rpm"],"src":["java-17-openjdk-17.0.20.8-4.oe2203sp4.src.rpm"],"x86_64":["java-17-openjdk-17.0.20.8-4.oe2203sp4.x86_64.rpm","java-17-openjdk-debuginfo-17.0.20.8-4.oe2203sp4.x86_64.rpm","java-17-openjdk-debugsource-17.0.20.8-4.oe2203sp4.x86_64.rpm","java-17-openjdk-demo-17.0.20.8-4.oe2203sp4.x86_64.rpm","java-17-openjdk-demo-slowdebug-17.0.20.8-4.oe2203sp4.x86_64.rpm","java-17-openjdk-devel-17.0.20.8-4.oe2203sp4.x86_64.rpm","java-17-openjdk-devel-slowdebug-17.0.20.8-4.oe2203sp4.x86_64.rpm","java-17-openjdk-headless-17.0.20.8-4.oe2203sp4.x86_64.rpm","java-17-openjdk-headless-slowdebug-17.0.20.8-4.oe2203sp4.x86_64.rpm","java-17-openjdk-javadoc-17.0.20.8-4.oe2203sp4.x86_64.rpm","java-17-openjdk-javadoc-zip-17.0.20.8-4.oe2203sp4.x86_64.rpm","java-17-openjdk-jmods-17.0.20.8-4.oe2203sp4.x86_64.rpm","java-17-openjdk-jmods-slowdebug-17.0.20.8-4.oe2203sp4.x86_64.rpm","java-17-openjdk-slowdebug-17.0.20.8-4.oe2203sp4.x86_64.rpm","java-17-openjdk-src-17.0.20.8-4.oe2203sp4.x86_64.rpm","java-17-openjdk-src-slowdebug-17.0.20.8-4.oe2203sp4.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:24.03-LTS-SP1","name":"openjdk-17","purl":"pkg:rpm/openEuler/openjdk-17&distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"java-17-openjdk-17.0.20.8-4.oe2403sp1"}]}],"ecosystem_specific":{"aarch64":["java-17-openjdk-17.0.20.8-4.oe2403sp1.aarch64.rpm","java-17-openjdk-debuginfo-17.0.20.8-4.oe2403sp1.aarch64.rpm","java-17-openjdk-debugsource-17.0.20.8-4.oe2403sp1.aarch64.rpm","java-17-openjdk-demo-17.0.20.8-4.oe2403sp1.aarch64.rpm","java-17-openjdk-demo-slowdebug-17.0.20.8-4.oe2403sp1.aarch64.rpm","java-17-openjdk-devel-17.0.20.8-4.oe2403sp1.aarch64.rpm","java-17-openjdk-devel-slowdebug-17.0.20.8-4.oe2403sp1.aarch64.rpm","java-17-openjdk-headless-17.0.20.8-4.oe2403sp1.aarch64.rpm","java-17-openjdk-headless-slowdebug-17.0.20.8-4.oe2403sp1.aarch64.rpm","java-17-openjdk-javadoc-17.0.20.8-4.oe2403sp1.aarch64.rpm","java-17-openjdk-javadoc-zip-17.0.20.8-4.oe2403sp1.aarch64.rpm","java-17-openjdk-jmods-17.0.20.8-4.oe2403sp1.aarch64.rpm","java-17-openjdk-jmods-slowdebug-17.0.20.8-4.oe2403sp1.aarch64.rpm","java-17-openjdk-slowdebug-17.0.20.8-4.oe2403sp1.aarch64.rpm","java-17-openjdk-src-17.0.20.8-4.oe2403sp1.aarch64.rpm","java-17-openjdk-src-slowdebug-17.0.20.8-4.oe2403sp1.aarch64.rpm"],"src":["java-17-openjdk-17.0.20.8-4.oe2403sp1.src.rpm"],"x86_64":["java-17-openjdk-17.0.20.8-4.oe2403sp1.x86_64.rpm","java-17-openjdk-debuginfo-17.0.20.8-4.oe2403sp1.x86_64.rpm","java-17-openjdk-debugsource-17.0.20.8-4.oe2403sp1.x86_64.rpm","java-17-openjdk-demo-17.0.20.8-4.oe2403sp1.x86_64.rpm","java-17-openjdk-demo-slowdebug-17.0.20.8-4.oe2403sp1.x86_64.rpm","java-17-openjdk-devel-17.0.20.8-4.oe2403sp1.x86_64.rpm","java-17-openjdk-devel-slowdebug-17.0.20.8-4.oe2403sp1.x86_64.rpm","java-17-openjdk-headless-17.0.20.8-4.oe2403sp1.x86_64.rpm","java-17-openjdk-headless-slowdebug-17.0.20.8-4.oe2403sp1.x86_64.rpm","java-17-openjdk-javadoc-17.0.20.8-4.oe2403sp1.x86_64.rpm","java-17-openjdk-javadoc-zip-17.0.20.8-4.oe2403sp1.x86_64.rpm","java-17-openjdk-jmods-17.0.20.8-4.oe2403sp1.x86_64.rpm","java-17-openjdk-jmods-slowdebug-17.0.20.8-4.oe2403sp1.x86_64.rpm","java-17-openjdk-slowdebug-17.0.20.8-4.oe2403sp1.x86_64.rpm","java-17-openjdk-src-17.0.20.8-4.oe2403sp1.x86_64.rpm","java-17-openjdk-src-slowdebug-17.0.20.8-4.oe2403sp1.x86_64.rpm"]}},{"package":{"ecosystem":"openEuler:24.03-LTS-SP3","name":"openjdk-17","purl":"pkg:rpm/openEuler/openjdk-17&distro=openEuler-24.03-LTS-SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"java-17-openjdk-17.0.20.8-4.oe2403sp3"}]}],"ecosystem_specific":{"aarch64":["java-17-openjdk-17.0.20.8-4.oe2403sp3.aarch64.rpm","java-17-openjdk-debuginfo-17.0.20.8-4.oe2403sp3.aarch64.rpm","java-17-openjdk-debugsource-17.0.20.8-4.oe2403sp3.aarch64.rpm","java-17-openjdk-demo-17.0.20.8-4.oe2403sp3.aarch64.rpm","java-17-openjdk-demo-slowdebug-17.0.20.8-4.oe2403sp3.aarch64.rpm","java-17-openjdk-devel-17.0.20.8-4.oe2403sp3.aarch64.rpm","java-17-openjdk-devel-slowdebug-17.0.20.8-4.oe2403sp3.aarch64.rpm","java-17-openjdk-headless-17.0.20.8-4.oe2403sp3.aarch64.rpm","java-17-openjdk-headless-slowdebug-17.0.20.8-4.oe2403sp3.aarch64.rpm","java-17-openjdk-javadoc-17.0.20.8-4.oe2403sp3.aarch64.rpm","java-17-openjdk-javadoc-zip-17.0.20.8-4.oe2403sp3.aarch64.rpm","java-17-openjdk-jmods-17.0.20.8-4.oe2403sp3.aarch64.rpm","java-17-openjdk-jmods-slowdebug-17.0.20.8-4.oe2403sp3.aarch64.rpm","java-17-openjdk-slowdebug-17.0.20.8-4.oe2403sp3.aarch64.rpm","java-17-openjdk-src-17.0.20.8-4.oe2403sp3.aarch64.rpm","java-17-openjdk-src-slowdebug-17.0.20.8-4.oe2403sp3.aarch64.rpm"],"src":["java-17-openjdk-17.0.20.8-4.oe2403sp3.src.rpm"],"x86_64":["java-17-openjdk-17.0.20.8-4.oe2403sp3.x86_64.rpm","java-17-openjdk-debuginfo-17.0.20.8-4.oe2403sp3.x86_64.rpm","java-17-openjdk-debugsource-17.0.20.8-4.oe2403sp3.x86_64.rpm","java-17-openjdk-demo-17.0.20.8-4.oe2403sp3.x86_64.rpm","java-17-openjdk-demo-slowdebug-17.0.20.8-4.oe2403sp3.x86_64.rpm","java-17-openjdk-devel-17.0.20.8-4.oe2403sp3.x86_64.rpm","java-17-openjdk-devel-slowdebug-17.0.20.8-4.oe2403sp3.x86_64.rpm","java-17-openjdk-headless-17.0.20.8-4.oe2403sp3.x86_64.rpm","java-17-openjdk-headless-slowdebug-17.0.20.8-4.oe2403sp3.x86_64.rpm","java-17-openjdk-javadoc-17.0.20.8-4.oe2403sp3.x86_64.rpm","java-17-openjdk-javadoc-zip-17.0.20.8-4.oe2403sp3.x86_64.rpm","java-17-openjdk-jmods-17.0.20.8-4.oe2403sp3.x86_64.rpm","java-17-openjdk-jmods-slowdebug-17.0.20.8-4.oe2403sp3.x86_64.rpm","java-17-openjdk-slowdebug-17.0.20.8-4.oe2403sp3.x86_64.rpm","java-17-openjdk-src-17.0.20.8-4.oe2403sp3.x86_64.rpm","java-17-openjdk-src-slowdebug-17.0.20.8-4.oe2403sp3.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3984"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60147"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"database_specific":{"severity":"Medium"}}