{"id":"SUSE-SU-2026:3331-1","summary":"Security update for java-25-openjdk","details":"This update for java-25-openjdk fixes the following issues:\n\nUpdate to upstream tag jdk-25.0.4+7 (July 2026 CPU).\n\nSecurity issues fixed:\n\n- CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in `CubeSize` (bsc#1264994).\n- CVE-2026-46917: unauthenticated attacker with network access via TLS can cause a partial denial of service\n  (bsc#1272223).\n- CVE-2026-46968: unauthenticated attacker with network access via TLS can gain unauthorized creation, deletion or\n  modification access to critical data(bsc#1272224).\n- CVE-2026-47010: unauthenticated attacker with network access via multiple protocols can gain unauthorized update,\n  insert or delete access to some data (bsc#1272225).\n- CVE-2026-47021: unauthenticated attacker with network access via multiple protocols can cause a partial denial of\n  service (bsc#1272227).\n- CVE-2026-47027: unauthenticated attacker with network access via multiple protocols can cause a partial denial of\n  service (bsc#1272228).\n- CVE-2026-47059: unauthenticated attacker with network access via multiple protocols can cause a partial denial of\n  service (bsc#1272235).\n- CVE-2026-47063: unauthenticated attacker with network access via multiple protocols can gain unauthorized creation,\n  deletion or modification access to critical data (bsc#1272236).\n- CVE-2026-60147: unauthenticated attacker with network access via multiple protocols can gain unauthorized update,\n  insert, delete and read access to some(bsc#1272237).\n\nOther updates and bugfixes:\n\n- Errors from update-alternatives when installing java-25-openjdk (bsc#1267355).\n- Make post scripts less noisy (bsc#1267355).\n- Use libalternatives instead of update-alternatives for distributions where libalternatives is available.\n- Update to upstream tag jdk-25.0.4+7 (July 2026 CPU):    \n    + JDK-7184899: Test sun/java2d/X11SurfaceData/\n      /SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail\n    + JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes\n      fails\n    + JDK-8064922: [macos] Test javax/swing/JTabbedPane/4624207/\n      /bug4624207.java fails\n    + JDK-8068293: [TEST_BUG] Test closed/com/sun/java/swing/plaf/\n      /motif/InternalFrame/4150591/bug4150591.java fails with\n      GTKLookAndFeel\n    + JDK-8068310: [TEST_BUG] Test javax/swing/JColorChooser/\n      /Test4234761.java fails with GTKL&F\n    + JDK-8144124: [macosx] The tabs can't be aligned when we\n      pressing the key of 'R','B','L','C' or 'T'.\n    + JDK-8203004: UnixMultiResolutionSplashTest.java fails on\n      Ubuntu16.04\n    + JDK-8213530: Test java/awt/Modal/ToFront/\n      /DialogToFrontModeless1Test.java fails on Linux\n    + JDK-8221451: PIT: sun/java2d/X11SurfaceData/\n      /SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fails\n    + JDK-8225787: java/awt/Window/GetScreenLocation/\n      /GetScreenLocationTest.java fails on Ubuntu\n    + JDK-8241066: Shenandoah: fix or cleanup SH::do_full_collection\n    + JDK-8261743: Shenandoah: enable String deduplication with\n      compact heuristics\n    + JDK-8264851: Shenandoah: Rework control loop mechanics to use\n      timed waits\n    + JDK-8278102: containers/docker/TestJcmd.java failed with\n      'RuntimeException: Could not find specified process'\n    + JDK-8279196: Test: jdk/jfr/event/gc/stacktrace/\n      /TestG1OldAllocationPendingStackTrace.java timed out\n    + JDK-8297191: [macos] Printing a page range with starting\n      page \u003e 1 results in missing pages\n    + JDK-8298823: [macos] java/awt/Mouse/EnterExitEvents/\n      /DragWindowTest.java continues to fail with 'No MouseReleased\n      event on label!'\n    + JDK-8319326: GC: Make TestParallelRefProc use\n      createTestJavaProcessBuilder\n    + JDK-8319540: GC: Make TestSelectDefaultGC use\n      createTestJavaProcessBuilder\n    + JDK-8321303: Intermittent open/test/jdk/java/awt/\n      /KeyboardFocusmanager/ConsumeNextMnemonicKeyTypedTest/\n      /ConsumeNextMnemonicKeyTypedTest.java failure on Linux\n    + JDK-8321687: Test vmTestbase/nsk/jvmti/scenarios/contention/\n      /TC03/tc03t002/TestDescription.java failed:\n      JVMTI_ERROR_THREAD_NOT_ALIVE\n    + JDK-8323792: ThreadSnapshot::initialize can cause assert in\n      Thread::check_for_dangling_thread_pointer (possibility of\n      dangling Thread pointer)\n    + JDK-8325482: Test that distinct seeds produce distinct traces\n      for compiler stress flags\n    + JDK-8335355: Shenandoah: Fix race condition in gc/shenandoah/\n      /mxbeans/TestPauseNotifications.java\n    + JDK-8339526: C2: store incorrectly removed for clone()\n      transformed to series of loads/stores\n    + JDK-8340182: Java HttpClient does not follow default retry\n      limit of 3 retries\n    + JDK-8341735: Rewrite the build/AbsPathsInImage.java test to\n      not load the entire file at once\n    + JDK-8344345: test/hotspot/gtest/x86/x86-asmtest.py has\n      trailing whitespaces\n    + JDK-8345631: TestRegionSamplingLogging.java\n      #generational-rotation intermittent fails\n    + JDK-8347167: Reduce allocation in\n      com.sun.net.httpserver.Headers::normalize\n    + JDK-8347938: Add Support for the Latest ML-KEM and ML-DSA\n      Private Key Encodings\n    + JDK-8351010: Test java/io/File/GetXSpace.java failed: / usable\n      space 56380809216 \u003e free space 14912244940\n    + JDK-8352914: Shenandoah: Change definition of\n      ShenandoahSharedValue to int32_t to leverage platform atomics\n    + JDK-8353115: GenShen: mixed evacuation candidate regions need\n      accurate live_data\n    + JDK-8354650: [PPC64] Try to reduce register definitions\n    + JDK-8355339: Test java/io/File/GetCanonicalPath.java failed:\n      The specified network name is no longer available\n    + JDK-8357086: os::xxx functions returning memory size should\n      return size_t\n    + JDK-8358600: Template-Framework Library: Template for\n      TestFramework test class\n    + JDK-8358772: Template-Framework Library: Primitive Types\n    + JDK-8359083: Test jdkCheckHtml.java should report\n      SkippedException rather than report fails when miss tidy\n    + JDK-8359223: HttpClient: Remove leftovers from the\n      SecurityManager cleanup\n    + JDK-8359412: Template-Framework Library: Operations and\n      Expressions\n    + JDK-8359433: The final modifier on Windows L&F internal UI\n      classes prevents extending them in apps\n    + JDK-8361339: Test gc/shenandoah/TestLargeObjectAlignment.java\n      #generational fails on macOS aarch64 with OOM: Java heap space\n    + JDK-8361606: ConsumeNextMnemonicKeyTypedTest.java fails on\n      Windows: character typed with VK_A: a\n    + JDK-8361699: C2: assert(can_reduce_phi(n-\u003eas_Phi())) failed:\n      Sanity: previous reducible Phi is no longer reducible before\n      SUT\n    + JDK-8361726: Shenandoah: More detailed evacuation\n      instrumentation\n    + JDK-8362428: Update IANA Language Subtag Registry to Version\n      2025-08-25\n    + JDK-8363943: ARM32: Represent Registers as values\n    + JDK-8363949: Incorrect jtreg header in\n      MonitorWithDeadObjectTest.java\n    + JDK-8363986: Heap region in CDS archive is not at\n      deterministic address\n    + JDK-8364315: Remove unused xml files from test/jaxp/javax/xml/\n      /jaxp/functional/javax/xml/transform/xmlfiles\n    + JDK-8364657: Crash for SecureRandom.generateSeed(0) on Windows\n      x86-64\n    + JDK-8364927: Add @requires annotation to\n      TestReclaimStringsLeaksMemory.java\n    + JDK-8365057: Add support for java.util.concurrent lock\n      information to Thread.dump_to_file\n    + JDK-8365379: SU3.applyInsets may produce wrong results\n    + JDK-8365423: [macos26] java/awt/MenuBar/8007006/\n      /bug8007006.java fails on macOS 26\n    + JDK-8365424: [macos26] java/awt/Frame/DisposeTest.java fails\n      on macOS 26\n    + JDK-8365623: test/jdk/sun/security/pkcs11/tls/ tests skipped\n      without skip exception\n    + JDK-8365625: Can't change accelerator colors in Windows L&F\n    + JDK-8365792: GenShen: assertion 'Generations aren't\n      reconciled'\n    + JDK-8366692: Several gc/shenandoah tests timed out\n    + JDK-8366695: Test sun/jvmstat/monitor/MonitoredVm/\n      /MonitorVmStartTerminate.java timed out\n    + JDK-8366852: java/awt/Choice/ChoiceMouseWheelTest/\n      /ChoiceMouseWheelTest.java test is failing\n    + JDK-8367096: jdk/open/test/jdk/sun/security/pkcs11/ rsa, ec,\n      config, secmod and sslecc tests are skipping but showing as\n      pass\n    + JDK-8367450: Shenandoah: Log the composition of the collection\n      set\n    + JDK-8367451: GenShen: Remove the option to compute age census\n      during evacuation\n    + JDK-8367473: Shenandoah: Make the detailed evacuation metrics\n      a runtime diagnostic option\n    + JDK-8367485: os::physical_memory is broken in 32-bit JVMs when\n      running on 64-bit OSes\n    + JDK-8367531: Template Framework: use scopes and tokens instead\n      of misbehaving immediate-return-queries\n    + JDK-8367646: [GenShen] Control thread may overwrite gc\n      cancellation cause set by mutator\n    + JDK-8367708: GenShen: Reduce total evacuation burden\n    + JDK-8367709: GenShen: Dirty cards for objects that get\n      promoted by safepoint that intervenes between allocation and\n      stores\n    + JDK-8367722: [GenShen] ShenandoahEvacuationStats is always\n      empty\n    + JDK-8367949: JFR: MethodTrace double-counts methods that catch\n      their own exceptions\n    + JDK-8368001: java/text/Format/NumberFormat/\n      /NumberRoundTrip.java timed out\n    + JDK-8368015: Shenandoah: fix error in computation of average\n      allocation rate\n    + JDK-8368041: Enhance TLS certificate handling\n    + JDK-8368159: Significant performance overhead when started\n      with jdwp agent and unattached debugger\n    + JDK-8368181: ProblemList java/awt/Dialog/ModalExcludedTest/\n      /ModalExcludedTest.java\n    + JDK-8368307: Shenandoah: get_next_bit_impl should special case\n      weak and strong mark bits\n    + JDK-8368499: GenShen: Do not collect age census during evac\n      when adaptive tenuring is disabled\n    + JDK-8368501: Shenandoah: GC progress evaluation does not use\n      generation\n    + JDK-8368524: Tests are skipped and shown as passed in test/\n      /jdk/sun/security/pkcs11/Cipher/KeyWrap\n    + JDK-8368681: Shenandoah: Add documentation comments for\n      ShenandoahAllocationRate\n    + JDK-8369128: ProblemList jdk/jfr/event/profiling/\n      /TestCPUTimeSampleQueueAutoSizes.java in Xcomp configs\n    + JDK-8369132: Disable vmTestbase/gc/vector/CircularListLow and\n      LinearListLow with SerialGC\n    + JDK-8369133: Disable gc/g1/TestShrinkAuxiliaryDataRunner.java\n      with UseLargePages option\n    + JDK-8369251: Opensource few tests\n    + JDK-8369561: sun/java2d/OpenGL/DrawBitmaskImage.java#id0:\n      Incorrect color for first pixel (actual=ff000000)\n    + JDK-8369683: Exclude runtime/Monitor/\n      /MonitorWithDeadObjectTest.java#DumpThreadsBeforeDetach on\n      Alpine Linux debug\n    + JDK-8369736: Add management interface for AOT cache creation\n    + JDK-8369817: [TESTBUG] EmptyPath::toString is ignored\n    + JDK-8369912: [TESTBUG] testlibrary_tests/template_framework/\n      /examples/TestExpressions.java fails with ArithmeticException:\n      / by zero - forgot to respect Expression.info\n    + JDK-8369950: TLS connection to IPv6 address fails with BCJSSE\n      due to IllegalArgumentException\n    + JDK-8370370: Add still more cases to WorstCaseTests\n    + JDK-8370489: Some compiler tests miss the @key randomness\n    + JDK-8370502: C2: segfault while adding node to IGVN worklist\n    + JDK-8370521: GenShen: Various code cleanup related to\n      promotion\n    + JDK-8370939: C2: SIGSEGV in SafePointNode::verify_input when\n      processing MH call from\n      Compile::process_late_inline_calls_no_inline()\n    + JDK-8371284: GenShen: Avoid unnecessary card marking\n    + JDK-8371381: [Shenandoah] Setting ergo flags should use\n      FLAG_SET_ERGO\n    + JDK-8371503: RETAIN_IMAGE_AFTER_TEST do not work for some\n      tests\n    + JDK-8371792: Refactor barrier loop tests out of TestIfMinMax\n    + JDK-8371893: [macOS] use dead_strip linker option to reduce\n      binary size\n    + JDK-8372272: Hotspot shared lib loading - add load attempts to\n      Events::log\n    + JDK-8372351: Add 2 WISeKey roots\n    + JDK-8372380: Make hs_err reporting more robust for unattached\n      threads\n    + JDK-8372513: Shenandoah: ShenandoahMaxRegionSize can produce\n      an unaligned heap alignment\n    + JDK-8372851: Modify java/io/File/GetXSpace.java to print path\n      on failure of native call\n    + JDK-8372861: Genshen: Override parallel_region_stride of\n      ShenandoahResetBitmapClosure to a reasonable value for better\n      parallelism\n    + JDK-8373039: Remove Incorrect Asserts in\n      shenandoahScanRemembered\n    + JDK-8373120: Virtual thread stuck in BLOCKED state\n    + JDK-8373239: Test java/awt/print/PrinterJob/PageRanges.java\n      fails with incorrect selection of printed pages\n    + JDK-8373275: Improve DTLS handshaking\n    + JDK-8373515: Migrate 'test/jdk/java/net/httpclient/' to\n      null-safe 'SimpleSSLContext' methods\n    + JDK-8373579: Problem list compiler/runtime/Test7196199.java\n    + JDK-8373650: Test 'javax/swing/JMenuItem/6458123/\n      /ManualBug6458123.java' fails because the check icons are not\n      aligned properly as expected\n    + JDK-8373676: Test javax/net/ssl/HttpsURLConnection/\n      /SubjectAltNameIP.java fails on a machine without IPV6\n    + JDK-8373690: Unexpected Keystore message using\n      jdk.crypto.disabledAlgorithms\n    + JDK-8373714: Shenandoah: Register heuristic penalties\n      following a degenerated GC\n    + JDK-8373718: jdk/internal/misc/VM/RuntimeArguments.java test\n      fails in Virtual threads mode\n    + JDK-8373796: Refactor java/net/httpclient/\n      /ThrowingPublishers*.java tests to use JUnit5\n    + JDK-8373847: Test javax/swing/JMenuItem/MenuItemTest/\n      /bug6197830.java failed because The test case automatically\n      fails when clicking any items in the “Nothing” menu in all\n      four windows (Left-to-right)-Menu Item Test and\n      (Right-to-left)-Menu Item Test\n    + JDK-8373866: Refactor java/net/httpclient/\n      /ThrowingSubscribers*.java tests to use JUnit5\n    + JDK-8373893: Refactor networking http server tests to use\n      JUnit\n    + JDK-8373913: Refactor serialization tests to use JUnit\n    + JDK-8373928: 4 Dangling pointer defect groups in java.c\n    + JDK-8374001: sun/security/ skip without Exceptions\n    + JDK-8374058: Enhance JPEG handling\n    + JDK-8374168: Resolve disabled warnings in JDWP agent\n    + JDK-8374304: MultiResolutionSplashTest.java fails in CI:\n      'Image with wrong resolution is used for splash screen!'\n    + JDK-8374322: TestMemoryWithSubgroups.java fails Permission\n      denied\n    + JDK-8374343: Fix SIGSEGV when lib/modules is unreadable\n    + JDK-8374449: Shenandoah: Leaf locks used by Shenandoah need\n      lower ranks\n    + JDK-8374506: Incorrect positioning of arrow icon in parent\n      JMenu in Windows L&F\n    + JDK-8374712: AOTMappedHeapWriter::relocate_field_in_buffer\n      should use CompressedOops::narrow_oop_cast\n    + JDK-8374727: Audio configuration Platform class - use nio for\n      getting endianness of the underlying platform\n    + JDK-8374744: Enable dumping of APX EGPRs (R16–R31) in JVM\n      fatal error logs\n    + JDK-8374769: PPC: MASM::pop_cont_fastpath() should reset\n      _cont_fastpath if SP == _cont_fastpath\n    + JDK-8374888: Implement internal test cache to help\n      UserIterCount test performance\n    + JDK-8374998: Failing os::write - remove bad file\n    + JDK-8375065: Update LCMS to 2.18\n    + JDK-8375177: Gtest\n      os_linux.decoder_get_source_info_valid_vm fails with\n      -ffunction-sections\n    + JDK-8375294: (fs) Files.copy can fail with EOPNOTSUPP when\n      copy_file_range not supported\n    + JDK-8376031: HttpsURLConnection.getServerCertificates() throws\n      'java.lang.IllegalStateException: connection not yet open' for\n      the HEAD method\n    + JDK-8376104: C2 crashes in PhiNode::Ideal(PhaseGVN*, bool)\n      accessing NULL pointer\n    + JDK-8376151: Test javax/swing/JFileChooser/4966171/\n      /bug4966171.java is failing with OOME\n    + JDK-8376152: Test javax/sound/sampled/Clip/bug5070081.java\n      timed out then completed\n    + JDK-8376185: NoSuchFieldError thrown after a record with type\n      annotation retransformed\n    + JDK-8376233: Clean up code in Desktop native peer\n    + JDK-8376287: Crashes when using -XX:ObjArrayMarkingStride=0\n    + JDK-8376402: Dependencies::print_statistics() and\n      AbstractClassHierarchyWalker::print_statistics() are not\n      called from PRODUCT code\n    + JDK-8376684: Compile OpenJDK in headless mode without required\n      X11 libraries\n    + JDK-8376956: Add JVMTI phase entering/setting to hserr event\n      log\n    + JDK-8376969: Shenandoah: GC state getters should be inlineable\n    + JDK-8376970: Shenandoah: Verifier should do basic verification\n      before touching oops\n    + JDK-8377158: Enhance XBM image support\n    + JDK-8377167: javax/imageio/ReadAbortTest.java throw NPE when\n      x11 unavailable\n    + JDK-8377498: Improve HttpServer handling\n    + JDK-8377512: AOT cache creation fails with invalid native\n      pointer\n    + JDK-8377602: Create automated test for PageRange\n    + JDK-8377727: Ghost caret and focus appear in non‑editable\n      text fields\n    + JDK-8377833: Enhance Jar file processing\n    + JDK-8377907: (process) Race in ProcessBuilder can cause JVM\n      hangs\n    + JDK-8377910: Minor cleanup of java/io/FileDescriptor/\n      /Sharing.java\n    + JDK-8377932: AOT cache is not rejected when JAR file has\n      changed\n    + JDK-8377944: LowMemoryTest2.java#id1 intermittent fails OOME:\n      Metaspace\n    + JDK-8377949: TestZRelocationSetEvent.java intermittent fails\n      OOME\n    + JDK-8378083: Mark shenandoah/generational/\n      /TestOldGrowthTriggers.java as flagless\n    + JDK-8378201: [OGL] glXMakeContextCurrent() drops the buffers\n      of the unbound drawable\n    + JDK-8378417: Printing All pages results in NPE for 1.1\n      PrintJob\n    + JDK-8378561: Mark gc/shenandoah/compiler/\n      /TestLinkToNativeRBP.java as /native\n    + JDK-8378687: Improve delegation of HttpURLConnection\n    + JDK-8378727: [macOS] Missing dispatch_release for semaphores\n      in CDesktopPeer\n    + JDK-8378746: ZGC: jdk/jfr/event/gc/detailed/\n      /TestZRelocationSetGroupEvent.java intermittent OOME\n    + JDK-8378764: fileStream::fileSize() fails for \u003e2GB files on\n      Windows\n    + JDK-8378774: Bump update version for OpenJDK: jdk-25.0.4\n    + JDK-8378810: Enable missing FFM test via jtreg requires for\n      RISC-V\n    + JDK-8378836: Enable linktime-gc by default on Linux ppc64le\n    + JDK-8378878: Refactor java/nio/channels/\n      /AsynchronousSocketChannel test to use JUnit\n    + JDK-8378888: jdk/incubator/vector/\n      /Float16OperationsBenchmark.java uses wrong package name\n    + JDK-8379021: Shenandoah: Speedup ShenandoahSimpleBitMapTest\n    + JDK-8379202: Support linktime-gc on Linux with clang\n    + JDK-8379416: AIX build fails if system (not GNU) date tool is\n      in PATH\n    + JDK-8379425: Windows and macOS should not allow unsupported\n      headless-only build\n    + JDK-8379457: Test EATests.java#id0 ERROR: monitor list errors:\n      error_cnt=1\n    + JDK-8379464: Enable missing stack walking test via jtreg\n      requires for RISC-V\n    + JDK-8379499: [AIX] headless-only build of libjawt.so fails\n    + JDK-8379515: draft-ietf-lamps-kyber-certificates is now\n      RFC 9935\n    + JDK-8380011: Path-to-gcroots search should not trigger stack\n      overflows\n    + JDK-8380041: PPC: remove POWER6 remnants\n    + JDK-8380222: Refactor test/jdk/java/lang/Character TestNG\n      tests to JUnit\n    + JDK-8380316: Test runtime/os/AvailableProcessors.java fails\n      Invalid argument\n    + JDK-8380409: JVM crashes when -XX:AOTMode=create uses\n      app.aotconf generated with JVMTI agent\n    + JDK-8380428: ProblemList containers/docker/\n      /TestJcmdWithSideCar.java on linux-all\n    + JDK-8380431: Shenandoah: Concurrent modification of\n      stack-chunk objects during evacuation\n    + JDK-8380474: Crash SEGV in ThreadIdTable::lazy_initialize\n      after JDK-8323792\n    + JDK-8380565: PPC64: deoptimization stub should save vector\n      registers\n    + JDK-8380663: Update jcmd man page to include AOT.end_recording\n      diagnostic command\n    + JDK-8380672: Improve certification checking\n    + JDK-8380846: GenShen: Remove the experimental option to\n      disable adaptive tenuring\n    + JDK-8380947: Add pull request template\n    + JDK-8381039: Enhance AWT ImagingLib\n    + JDK-8381049: Enhance Jar handling\n    + JDK-8381205: GHA: Upgrade Node.js 20 to 24\n    + JDK-8381315: compiler/vectorapi/TestVectorReallocation.java\n      fails with -XX:UseAVX=1 after JDK-8380565\n    + JDK-8381382: Shenandoah: assert(capacity \u003e 0) failed: free\n      regions must have allocation capacity\n    + JDK-8381519: Enhance Der Value Handling\n    + JDK-8381796: Enhance Certificate parsing\n    + JDK-8381871: GenShen: ShenandoahGCHeuristics flag not reset\n      after ignoring non-adaptive value\n    + JDK-8381935: Improve numChunks range in the PPC64 CallAranger\n    + JDK-8381937: Make exceptions in\n      Java_sun_security_mscapi_CKeyPairGenerator generateCKeyPair\n      more specific\n    + JDK-8382018: test/jdk/java/nio/file/spi/\n      /SetDefaultProvider.java leaves a directory in /tmp\n    + JDK-8382020: Time Zone Abbreviation Not Localized for\n      Non-English Locales\n    + JDK-8382035: [ubsan] Under UBSAN builds, disable tests that\n      rely on simulated JVM crashes\n    + JDK-8382090: Remove .rej and .orig from .gitignore\n    + JDK-8382242: JFR: Metadata reconstruction invalidates\n      ConstantMap for java.lang.String\n    + JDK-8382295: Shenandoah: wrong denominator in full gc summary\n    + JDK-8382395: Disable stringop-overflow in\n      shenandoahGenerationalHeap.cpp\n    + JDK-8382419: Add missed @key randomness after JDK-8370489\n    + JDK-8382522: Disable stringop-overflow in\n      safepointMechanism.cpp\n    + JDK-8382740: JFR: Disable jdk.OldObjectSample event for\n      generational ZGC\n    + JDK-8382878: RISC-V: Missing InlineSkippedInstructionsCounter\n      in ZGC barriers stubs\n    + JDK-8382932: [25u] Test java/lang/instrument/\n      /RetransformRecordTypeAnn/TestRetransformRecord.java\u200e fails\n      with compilation error\n    + JDK-8383161: [PPC64]\n      MachCallDynamicJavaNode::ret_addr_offset() needs adaptation\n      for COH\n    + JDK-8383175: (tz) Update Timezone Data to 2026b\n    + JDK-8383183: Shenandoah: Mangle trashed regions up to top\n      instead of end\n    + JDK-8383354: Update LCMS to 2.19.1\n    + JDK-8383473: Follow on from tzdata2026b time change to\n      include temporary hack BC time change\n    + JDK-8383601: RISC-V:\n      ShenandoahBarrierSetAssembler::load_reference_barrier calls\n      'weak' on 'phantom' path\n    + JDK-8383630: Fix iteration in tests doing class redefinition\n    + JDK-8384043: [REDO] Incorrect handling of Hawaii_Aleutian\n      metazone\n    + JDK-8384158: GHA: Downgrade Windows GHA runners to\n      windows-2022 temporarily\n    + JDK-8384163: (so) SocketChannel.connect and finishConnect()\n      exception messages could be improved\n    + JDK-8384223: RISC-V: entry_barrier_offset should consider\n      UseZtso\n    + JDK-8384486: NTLM tests fail on Windows 11 and Windows Server\n      2025\n    + JDK-8384495: Update Libpng to 1.6.58\n    + JDK-8384540: [25u, 21u, 17u] Update GHA JDKs after Apr/26\n      updates\n    + JDK-8384815: SelectOneKeyOutOfMany and PreferredKey fail after\n      expired test certificate\n    + JDK-8384902: Update GIFlib to 6.1.3\n    + JDK-8385390: Update FreeType to 2.14.3\n    + JDK-8385490: Update HarfBuzz to 14.2.0\n    + JDK-8386551: Windows build broken because of MSys2/Make update\n","modified":"2026-07-29T18:24:18.984787816Z","published":"2026-07-28T09:36:57Z","related":["CVE-2026-41254","CVE-2026-46917","CVE-2026-46968","CVE-2026-47010","CVE-2026-47021","CVE-2026-47027","CVE-2026-47059","CVE-2026-47063","CVE-2026-60147"],"upstream":["CVE-2026-41254","CVE-2026-46917","CVE-2026-46968","CVE-2026-47010","CVE-2026-47021","CVE-2026-47027","CVE-2026-47059","CVE-2026-47063","CVE-2026-60147"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263331-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264398"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264994"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267355"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272223"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272224"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272225"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272227"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272228"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272235"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272236"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272237"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-41254"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46917"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46968"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-47010"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-47021"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-47027"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-47059"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-47063"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-60147"}],"affected":[{"package":{"name":"java-25-openjdk","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","purl":"pkg:rpm/suse/java-25-openjdk&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.4.0-150700.15.13.1"}]}],"ecosystem_specific":{"binaries":[{"java-25-openjdk-demo":"25.0.4.0-150700.15.13.1","java-25-openjdk-devel":"25.0.4.0-150700.15.13.1","java-25-openjdk-headless":"25.0.4.0-150700.15.13.1","java-25-openjdk":"25.0.4.0-150700.15.13.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3331-1.json"}}],"schema_version":"1.7.5"}