{"id":"SUSE-SU-2026:3406-1","summary":"Security update for java-17-openjdk","details":"This update for java-17-openjdk fixes the following issues:\n\nUpgrade to upstream tag jdk-17.0.20+8 (July 2026 CPU).\n\nSecurity issues fixed:\n\n- CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in `CubeSize` (bsc#1264994).\n- CVE-2026-46917: unauthenticated attacker with network access via TLS can cause a partial denial of service\n  (bsc#1272223).\n- CVE-2026-46968: unauthenticated attacker with network access via TLS can gain unauthorized creation, deletion or\n  modification access to critical data (bsc#1272224).\n- CVE-2026-47010: unauthenticated attacker with network access via multiple protocols can gain unauthorized update,\n  insert or delete access to some data (bsc#1272225).\n- CVE-2026-47021: unauthenticated attacker with network access via multiple protocols can cause a partial denial of\n  service (bsc#1272227).\n- CVE-2026-47027: unauthenticated attacker with network access via multiple protocols can cause a partial denial of\n  service (bsc#1272228).\n- CVE-2026-47059: unauthenticated attacker with network access via multiple protocols can cause a partial denial of\n  service (bsc#1272235).\n- CVE-2026-47063: unauthenticated attacker with network access via multiple protocols can gain unauthorized creation,\n  deletion or modification access to critical data (bsc#1272236).\n- CVE-2026-60147: unauthenticated attacker with network access via multiple protocols can gain unauthorized update,\n  insert, delete and read access to some data (bsc#1272237).\n\nOther updates and bugfixes:\n\n- Make post scripts less noisy (bsc#1267355).\n- Use `libalternatives` instead of `update-alternatives` for distributions where `libalternatives` is available.\n- Upgrade to upstream tag jdk-17.0.20+8 (July 2026 CPU):\n    + JDK-7184899: Test sun/java2d/X11SurfaceData/\n      /SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail\n    + JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes fails\n    + JDK-8064922: [macos] Test javax/swing/JTabbedPane/4624207/\n      /bug4624207.java fails\n    + JDK-8068293: [TEST_BUG] Test closed/com/sun/java/swing/plaf/\n      /motif/InternalFrame/4150591/bug4150591.java fails with\n      GTKLookAndFeel\n    + JDK-8068310: [TEST_BUG] Test javax/swing/JColorChooser/\n      /Test4234761.java fails with GTKL&F\n    + JDK-8068378: [TEST_BUG]The java/awt/Modal/PrintDialogsTest/\n      /PrintDialogsTest.java instruction need to update\n    + JDK-8183336: Better cleanup for jdk/test/java/lang/module/\n      /customfs/ModulesInCustomFileSystem.java\n    + JDK-8221451: PIT: sun/java2d/X11SurfaceData/\n      /SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fails\n    + JDK-8240908: RetransformClass does not know about\n      MethodParameters attribute\n    + JDK-8255463: java/nio/channels/spi/SelectorProvider/\n      /inheritedChannel/InheritedChannelTest.java failed with\n      ThreadTimeoutException\n    + JDK-8272477: Additional cleanup of test/jdk/java/nio/file/spi/\n      /SetDefaultProvider.java\n    + JDK-8274082: Wrong test name in jtreg run tag for java/awt/\n      /print/PrinterJob/SwingUIText.java\n    + JDK-8277444: Data race between\n      JvmtiClassFileReconstituter::copy_bytecodes and class linking\n    + JDK-8281243: Test java/lang/instrument/\n      /RetransformWithMethodParametersTest.java is failing\n    + JDK-8282044: [JVMCI] Export _sha3_implCompress,\n      _md5_implCompress and aarch64::_has_negatives stubs to JVMCI\n      compiler.\n    + JDK-8284993: Replace System.exit call in swing tests with\n      RuntimeException\n    + JDK-8286258: [Accessibility,macOS,VoiceOver] VoiceOver reads\n      the spinner value wrong and sometime partially\n    + JDK-8286865: vmTestbase/vm/mlvm/meth/stress/jni/\n      /nativeAndMH/Test.java fails with Out of space in CodeCache\n    + JDK-8287062: com/sun/jndi/ldap/LdapPoolTimeoutTest.java failed\n      due to different timeout message\n    + JDK-8290504: Close streams returned by ModuleReader::list\n    + JDK-8293484: AArch64:\n      TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails on CPU\n      with SHA512 feature support\n    + JDK-8297191: [macos] Printing a page range with starting\n      page \u003e 1 results in missing pages\n    + JDK-8298783: java/lang/ref/FinalizerHistogramTest.java failed\n      with 'RuntimeException: MyObject is not found in test output'\n    + JDK-8298823: [macos] java/awt/Mouse/EnterExitEvents/\n      /DragWindowTest.java continues to fail with 'No MouseReleased\n      event on label!'\n    + JDK-8299304: Test 'java/awt/print/PrinterJob/\n      /PageDialogTest.java' fails on macOS 13 x64 because the Page\n      Dialog blocks the Toolkit\n    + JDK-8304065: HttpServer.stop should terminate immediately if\n      no exchanges are in progress\n    + JDK-8309142: Refactor test/langtools/tools/javac/versions/\n      /Versions.java\n    + JDK-8316274: javax/swing/ButtonGroup/\n      /TestButtonGroupFocusTraversal.java fails in Ubuntu 23.10 with\n      Motif LAF\n    + JDK-8317801: java/net/Socket/asyncClose/Race.java fails\n      intermittently (aix)\n    + JDK-8320677: Printer tests use invalid '@run main/manual=yesno\n    + JDK-8321182: SourceExample.SOURCE_14 comment should refer to\n      'switch expressions' instead of 'text blocks'\n    + JDK-8321303: Intermittent open/test/jdk/java/awt/\n      /KeyboardFocusmanager/ConsumeNextMnemonicKeyTypedTest/\n      /ConsumeNextMnemonicKeyTypedTest.java failure on Linux\n    + JDK-8323089: networkaddress.cache.ttl is not a system property\n    + JDK-8323545: java/awt/GraphicsDevice/CheckDisplayModes.java\n      fails with 'exit code: 133'\n    + JDK-8323672: Suppress unwanted autoconf added flags in CC and\n      CXX\n    + JDK-8324345: Stack overflow during C2 compilation when\n      splitting memory phi\n    + JDK-8324641: [IR Framework] Add Setup method to provide custom\n      arguments and set fields\n    + JDK-8328300: Convert PrintDialogsTest.java from Applet to main\n      program\n    + JDK-8332495: java/util/logging/LoggingDeadlock2.java fails\n      with AssertionError: Some tests failed\n    + JDK-8334928: Test sun/security/ssl/SSLSocketImpl/\n      /ReuseAddr.java failed: java.net.BindException: Address\n      already in use\n    + JDK-8337876: [IR Framework] Add support for IR tests with\n      @Stable\n    + JDK-8338103: Stabilize and open source a Swing OGL\n      ButtonResizeTest\n    + JDK-8338112: Test testlibrary_tests/ir_framework/tests/\n      /TestPrivilegedMode.java fails with release build\n    + JDK-8338344: Test TestPrivilegedMode.java intermittent fails\n      java.lang.NoClassDefFoundError: jdk/test/lib/Platform\n    + JDK-8338554: Fix inconsistencies in javadoc/doclet/\n      /testLinkOption/TestRedirectLinks.java\n    + JDK-8338883: Show warning when CreateCoredumpOnCrash set, but\n      core dump will not happen\n    + JDK-8339233: Test javax/swing/JButton/\n      /SwingButtonResizeTestWithOpenGL.java#id failed: Button\n      renderings are different after window resize\n    + JDK-8339238: Update to use jtreg 7.5.1\n    + JDK-8339879: Open some dialog awt tests\n    + JDK-8339975: Open some dialog awt tests 2\n    + JDK-8340140: Open some dialog awt tests 3\n    + JDK-8340336: Open some checkbox awt tests\n    + JDK-8340494: Open some dialog awt tests 4\n    + JDK-8340851: Open some TextArea awt tests\n    + JDK-8340987: Open some TextArea awt tests 1\n    + JDK-8341055: Open some TextArea awt tests 2\n    + JDK-8341292: Open some TextArea awt tests 3\n    + JDK-8341376: Open some TextArea awt tests 4\n    + JDK-8341427: JFR: Adjust object sampler span handling\n    + JDK-8342401: [TESTBUG] javax/swing/JSpinner/8223788/\n      /JSpinnerButtonFocusTest.java test fails in ubuntu 22.04 on\n      SBR Hosts\n    + JDK-8345618: javax/swing/text/Caret/8163124/\n      /CaretFloatingPointAPITest.java leaves Caret is not complete\n    + JDK-8346154: [XWayland] Some tests fail intermittently in the\n      CI, but not locally\n    + JDK-8347811: Container detection code for cgroups v2 should\n      use cgroup.controllers\n    + JDK-8347836: Disabled PopupMenu shows shortcuts on Mac\n    + JDK-8349192: jvmti/scenarios/contention/TC05/tc05t001 fails:\n      ERROR: tc05t001.cpp, 281: (waitedThreadCpuTime -\n      waitThreadCpuTime) \u003c (EXPECTED_ACCURACY * 1000000)\n    + JDK-8349533: Refactor validator tests shell files to java\n    + JDK-8349988: Change cgroup version detection logic to not\n      depend on /proc/cgroups\n    + JDK-8350749: Upgrade JLine to 3.29.0\n    + JDK-8352685: Opensource JInternalFrame tests - series2\n    + JDK-8352733: Improve RotFontBoundsTest test\n    + JDK-8352877: Opensource Several Font related tests - Batch 1\n    + JDK-8353488: Open some JComboBox bugs 3\n    + JDK-8353552: Opensource Several Font related tests - Batch 3\n    + JDK-8354163: Open source Swing tests Batch 1\n    + JDK-8354469: Keytool exposes the password in plain text when\n      command is piped using | grep\n    + JDK-8354695: Open source several swing tests batch7\n    + JDK-8354878: File Leak in\n      CgroupSubsystemFactory::determine_type of\n      cgroupSubsystem_linux.cpp:300\n    + JDK-8354900: javax/swing/AbstractButton/bug4133768.java\n      failing on macosx-aarch64\n    + JDK-8355048: ProblemList TestGlyphVectorLayout.java on all\n      platforms\n    + JDK-8355179: Reinstate javax/swing/JScrollBar/4865918/\n      /bug4865918.java headful and macos run\n    + JDK-8355332: Fix failing semi-manual test EDT issue\n    + JDK-8355443: [java.io] Use @requires tag instead of exiting\n      based on File.separatorChar value\n    + JDK-8355445: [java.nio] Use @requires tag instead of exiting\n      based on 'os.name' property value\n    + JDK-8356107: [java.lang] Use @requires tag instead of exiting\n      based on os.name or separatorChar property\n    + JDK-8357062: Update Public Suffix List to 823beb1\n    + JDK-8357082: Stabilize and add debug logs to CopyAreaOOB.java\n    + JDK-8357141: Update to use jtreg 7.5.2\n    + JDK-8357280: (bf) Remove @requires tags from java/nio/Buffer/\n      /LimitDirectMemory[NegativeTest].java\n    + JDK-8357390: java/awt/Toolkit/ScreenInsetsTest/\n      /ScreenInsetsTest.java Test failing on Ubuntu 24.04 Vm Hosts\n      used by Oracle's internal CI system\n    + JDK-8358058: sun/java2d/OpenGL/DrawImageBg.java Test fails\n      intermittently\n    + JDK-8358751: C2: Recursive inlining check for compiled lambda\n      forms is broken\n    + JDK-8359978: Test javax/net/ssl/SSLSocket/Tls13PacketSize.java\n      failed again with java.net.SocketException: An established\n      connection was aborted by the software in your host machine\n    + JDK-8360160: ubuntu-22-04 machine is failing client tests\n    + JDK-8360882: Tests throw SkippedException when they should\n      fail\n    + JDK-8361106: [TEST] com/sun/net/httpserver/Test9.java fails\n      with java.nio.file.FileSystemException\n    + JDK-8361606: ConsumeNextMnemonicKeyTypedTest.java fails on\n      Windows: character typed with VK_A: a\n    + JDK-8362428: Update IANA Language Subtag Registry to Version\n      2025-08-25\n    + JDK-8364190: JFR: RemoteRecordingStream withers don't work\n    + JDK-8364315: Remove unused xml files from test/jaxp/javax/xml/\n      /jaxp/functional/javax/xml/transform/xmlfiles\n    + JDK-8364927: Add @requires annotation to\n      TestReclaimStringsLeaksMemory.java\n    + JDK-8365379: SU3.applyInsets may produce wrong results\n    + JDK-8365423: [macos26] java/awt/MenuBar/8007006/\n      /bug8007006.java fails on macOS 26\n    + JDK-8365424: [macos26] java/awt/Frame/DisposeTest.java fails\n      on macOS 26\n    + JDK-8365526: Crash with null Symbol passed to\n      SystemDictionary::resolve_or_null\n    + JDK-8365625: Can't change accelerator colors in Windows L&F\n    + JDK-8366128: jdk/jdk/nio/zipfs/TestPosix.java::testJarFile\n      uses wrong file\n    + JDK-8366261: Provide utility methods for\n      sun.security.util.Password\n    + JDK-8366369: Add @requires linux for GTK L&F tests\n    + JDK-8366852: java/awt/Choice/ChoiceMouseWheelTest/\n      /ChoiceMouseWheelTest.java test is failing\n    + JDK-8367583: sun/security/util/AlgorithmConstraints/\n      /InvalidCryptoDisabledAlgos.java fails after JDK-8244336\n    + JDK-8367772: Refactor createUI in PassFailJFrame\n    + JDK-8367784: java/awt/Focus/InitialFocusTest/\n      /InitialFocusTest1.java failed with Wrong focus owner\n    + JDK-8368041: Enhance TLS certificate handling\n    + JDK-8368335: Refactor the rest of Locale TestNG based tests to\n      JUnit\n    + JDK-8368498: Use JUnit instead of TestNG for jdk_text tests\n    + JDK-8368551: Core dump warning may be confusing\n    + JDK-8368670: Deadlock in JFR on event register + class load\n    + JDK-8368683: [process] Increase jtreg debug output\n      maxOutputSize for TreeTest\n    + JDK-8368754: runtime/cds/appcds/SignedJar.java log regex is\n      too strict\n    + JDK-8368885: NMT CommandLine tests can check for error better\n    + JDK-8368892: Make JEditorPane/TestBrowserBGColor.java headless\n    + JDK-8369251: Opensource few tests\n    + JDK-8369319: java/net/httpclient/CancelRequestTest.java fails\n      intermittently\n    + JDK-8369335: Two  sun/java2d/OpenGL tests fail on Windows\n      after JDK-8358058\n    + JDK-8369561: sun/java2d/OpenGL/DrawBitmaskImage.java#id0:\n      Incorrect color for first pixel (actual=ff000000)\n    + JDK-8369851: Remove darcy author tags from langtools tests\n    + JDK-8369858: Remove darcy author tags from jdk tests\n    + JDK-8369911: Test sun/java2d/marlin/ClipShapeTest.java\n      #CubicDoDash, #Cubic and #Poly fail intermittent\n    + JDK-8369950: TLS connection to IPv6 address fails with BCJSSE\n      due to IllegalArgumentException\n    + JDK-8370325: G1: Disallow GC for TLAB allocation\n    + JDK-8370511: test/jdk/javax/swing/JSlider/bug4382876.java does\n      not release previously pressed keys\n    + JDK-8370732: Use WhiteBox.getWhiteBox().fullGC() to provoking\n      gc for nsk/jvmti tests\n    + JDK-8370942: test/jdk/java/security/Provider/NewInstance.java\n      and /test/jdk/java/security/cert/CertStore/NoLDAP.java may\n      skip without notifying\n    + JDK-8371365: Update javax/swing/JFileChooser/bug4759934.java\n      to use Util.findComponent()\n    + JDK-8371366: java/net/httpclient/whitebox/\n      /RawChannelTestDriver.java fails intermittently in jtreg\n      timeout\n    + JDK-8371383: Test sun/security/tools/jarsigner/\n      /DefaultOptions.java failed due to\n      CertificateNotYetValidException\n    + JDK-8371503: RETAIN_IMAGE_AFTER_TEST do not work for some\n      tests\n    + JDK-8372120: Add missing sound keyword to MIDI tests\n    + JDK-8372351: Add 2 WISeKey roots\n    + JDK-8372609: Bug4944439 does not enforce locale correctly\n    + JDK-8372661: Add a null-safe static factory method to\n      'jdk.test.lib.net.SimpleSSLContext'\n    + JDK-8372988: Test runtime/Nestmates/membership/\n      /TestNestHostErrorWithMultiThread.java failed: Unexpected\n      interrupt\n    + JDK-8373101: JdkClient and JdkServer test classes ignore\n      namedGroups field\n    + JDK-8373239: Test java/awt/print/PrinterJob/PageRanges.java\n      fails with incorrect selection of printed pages\n    + JDK-8373275: Improve DTLS handshaking\n    + JDK-8373623: Refactor Serialization tests for Records to JUnit\n    + JDK-8373650: Test 'javax/swing/JMenuItem/6458123/\n      /ManualBug6458123.java' fails because the check icons are not\n      aligned properly as expected\n    + JDK-8373690: Unexpected Keystore message using\n      jdk.crypto.disabledAlgorithms\n    + JDK-8373716: Refactor further java/util tests from TestNG to\n      JUnit\n    + JDK-8373807: test/jdk/java/net/httpclient/websocket/\n      /DummyWebSocketServer.java getURI() uses 'localhost'\n    + JDK-8373847: Test javax/swing/JMenuItem/MenuItemTest/\n      /bug6197830.java failed because The test case automatically\n      fails when clicking any items in the “Nothing” menu in all\n      four windows (Left-to-right)-Menu Item Test and\n      (Right-to-left)-Menu Item Test\n    + JDK-8373869: Refactor java/net/httpclient/\n      /ThrowingPushPromises*.java tests to use JUnit5\n    + JDK-8373928: 4 Dangling pointer defect groups in java.c\n    + JDK-8373931: Test javax/sound/sampled/Clip/\n      /AutoCloseTimeCheck.java timed out\n    + JDK-8374058: Enhance JPEG handling\n    + JDK-8374178: Missing include in systemDictionary.cpp after\n      JDK-8365526\n    + JDK-8374304: MultiResolutionSplashTest.java fails in CI:\n      'Image with wrong resolution is used for splash screen!'\n    + JDK-8374433: java/util/Locale/PreserveTagCase.java does not\n      run any tests\n    + JDK-8374506: Incorrect positioning of arrow icon in parent\n      JMenu in Windows L&F\n    + JDK-8374548: Process httpserver cancelled keys more quickly\n    + JDK-8374555: No need for visible input warning in\n      s.s.u.Password when not reading from System.in\n    + JDK-8374711: Hotspot runtime/CommandLine/OptionsValidation/\n      /TestOptionsWithRanges fails without printing the option name\n    + JDK-8374888: Implement internal test cache to help\n      UserIterCount test performance\n    + JDK-8374998: Failing os::write - remove bad file\n    + JDK-8375065: Update LCMS to 2.18\n    + JDK-8375080: The tools/jpackage/windows/Win8365790Test.java\n      may fail with ClassNotFoundException: jtreg.SkippedException\n    + JDK-8375231: Refactor util/ServiceLoader tests to use JUnit\n    + JDK-8375232: Refactor util/StringJoiner tests to use JUnit\n    + JDK-8375233: Refactor util/Vector tests to use JUnit\n    + JDK-8375999: com/sun/jndi/ldap/LdapPoolTimeoutTest.java fails\n      sporadically on Windows\n    + JDK-8376031: HttpsURLConnection.getServerCertificates() throws\n      'java.lang.IllegalStateException: connection not yet open' for\n      the HEAD method\n    + JDK-8376152: Test javax/sound/sampled/Clip/bug5070081.java\n      timed out then completed\n    + JDK-8376233: Clean up code in Desktop native peer\n    + JDK-8377158: Enhance XBM image support\n    + JDK-8377167: javax/imageio/ReadAbortTest.java throw NPE when\n      x11 unavailable\n    + JDK-8377498: Improve HttpServer handling\n    + JDK-8377602: Create automated test for PageRange\n    + JDK-8377678: G1: Heap Dumping crashes with -UseClassUnloading\n    + JDK-8377727: Ghost caret and focus appear in non‑editable text\n      fields\n    + JDK-8377833: Enhance Jar file processing\n    + JDK-8377910: Minor cleanup of java/io/FileDescriptor/\n      /Sharing.java\n    + JDK-8377944: LowMemoryTest2.java#id1 intermittent fails OOME:\n      Metaspace\n    + JDK-8378113: Add sun/java2d/OpenGL/ScaleParamsOOB.java to the\n      ProblemList.txt file\n    + JDK-8378201: [OGL] glXMakeContextCurrent() drops the buffers\n      of the unbound drawable\n    + JDK-8378417: Printing All pages results in NPE for 1.1\n      PrintJob\n    + JDK-8378687: Improve delegation of HttpURLConnection\n    + JDK-8378777: Bump update version for OpenJDK: jdk-17.0.20\n    + JDK-8378802: [21u] backport changes to TKit.java by\n      JDK-8352419\n    + JDK-8380316: Test runtime/os/AvailableProcessors.java fails\n      Invalid argument\n    + JDK-8380565: PPC64: deoptimization stub should save vector\n      registers\n    + JDK-8380672: Improve certification checking\n    + JDK-8380947: Add pull request template\n    + JDK-8381039: Enhance AWT ImagingLib\n    + JDK-8381049: Enhance Jar handling\n    + JDK-8381205: GHA: Upgrade Node.js 20 to 24\n    + JDK-8381519: Enhance Der Value Handling\n    + JDK-8381796: Enhance Certificate parsing\n    + JDK-8382242: JFR: Metadata reconstruction invalidates\n      ConstantMap for java.lang.String\n    + JDK-8383175: (tz) Update Timezone Data to 2026b\n    + JDK-8383354: Update LCMS to 2.19.1\n    + JDK-8383473: Follow on from tzdata2026b time change to include\n      temporary hack BC time change\n    + JDK-8383601: RISC-V:\n      ShenandoahBarrierSetAssembler::load_reference_barrier calls\n      'weak' on 'phantom' path\n    + JDK-8383630: Fix iteration in tests doing class redefinition\n    + JDK-8383659: [17u] JVM crashes during stub routines generation\n      on Windows and rare combination of CPU features\n    + JDK-8384158: GHA: Downgrade Windows GHA runners to\n      windows-2022 temporarily\n    + JDK-8384486: NTLM tests fail on Windows 11 and Windows Server\n      2025\n    + JDK-8384495: Update Libpng to 1.6.58\n    + JDK-8384540: [25u, 21u, 17u] Update GHA JDKs after Apr/26\n      updates\n    + JDK-8384815: SelectOneKeyOutOfMany and PreferredKey fail after\n      expired test certificate\n    + JDK-8384902: Update GIFlib to 6.1.3\n    + JDK-8385390: Update FreeType to 2.14.3\n    + JDK-8385490: Update HarfBuzz to 14.2.0\n    + JDK-8386343: [17u] Fix NTLMHeadTest after backport of 8384486\n    + JDK-8386551: Windows build broken because of MSys2/Make update\n","modified":"2026-07-30T17:15:07.255066506Z","published":"2026-07-29T11:10:07Z","related":["CVE-2026-41254","CVE-2026-46917","CVE-2026-46968","CVE-2026-47010","CVE-2026-47021","CVE-2026-47027","CVE-2026-47059","CVE-2026-47063","CVE-2026-60147"],"upstream":["CVE-2026-41254","CVE-2026-46917","CVE-2026-46968","CVE-2026-47010","CVE-2026-47021","CVE-2026-47027","CVE-2026-47059","CVE-2026-47063","CVE-2026-60147"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263406-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264396"},{"type":"REPORT","url":"https://bugzilla.suse.com/1264994"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267355"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272223"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272224"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272225"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272227"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272228"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272235"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272236"},{"type":"REPORT","url":"https://bugzilla.suse.com/1272237"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-41254"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46917"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-46968"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-47010"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-47021"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-47027"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-47059"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-47063"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-60147"}],"affected":[{"package":{"name":"java-17-openjdk","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","purl":"pkg:rpm/suse/java-17-openjdk&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.20.0-150400.3.69.1"}]}],"ecosystem_specific":{"binaries":[{"java-17-openjdk-devel":"17.0.20.0-150400.3.69.1","java-17-openjdk-headless":"17.0.20.0-150400.3.69.1","java-17-openjdk":"17.0.20.0-150400.3.69.1","java-17-openjdk-demo":"17.0.20.0-150400.3.69.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3406-1.json"}},{"package":{"name":"java-17-openjdk","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","purl":"pkg:rpm/suse/java-17-openjdk&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.20.0-150400.3.69.1"}]}],"ecosystem_specific":{"binaries":[{"java-17-openjdk-demo":"17.0.20.0-150400.3.69.1","java-17-openjdk-devel":"17.0.20.0-150400.3.69.1","java-17-openjdk-headless":"17.0.20.0-150400.3.69.1","java-17-openjdk":"17.0.20.0-150400.3.69.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3406-1.json"}},{"package":{"name":"java-17-openjdk","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","purl":"pkg:rpm/suse/java-17-openjdk&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.20.0-150400.3.69.1"}]}],"ecosystem_specific":{"binaries":[{"java-17-openjdk-devel":"17.0.20.0-150400.3.69.1","java-17-openjdk-headless":"17.0.20.0-150400.3.69.1","java-17-openjdk":"17.0.20.0-150400.3.69.1","java-17-openjdk-demo":"17.0.20.0-150400.3.69.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3406-1.json"}},{"package":{"name":"java-17-openjdk","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","purl":"pkg:rpm/suse/java-17-openjdk&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.20.0-150400.3.69.1"}]}],"ecosystem_specific":{"binaries":[{"java-17-openjdk":"17.0.20.0-150400.3.69.1","java-17-openjdk-demo":"17.0.20.0-150400.3.69.1","java-17-openjdk-devel":"17.0.20.0-150400.3.69.1","java-17-openjdk-headless":"17.0.20.0-150400.3.69.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3406-1.json"}},{"package":{"name":"java-17-openjdk","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","purl":"pkg:rpm/suse/java-17-openjdk&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.20.0-150400.3.69.1"}]}],"ecosystem_specific":{"binaries":[{"java-17-openjdk":"17.0.20.0-150400.3.69.1","java-17-openjdk-demo":"17.0.20.0-150400.3.69.1","java-17-openjdk-devel":"17.0.20.0-150400.3.69.1","java-17-openjdk-headless":"17.0.20.0-150400.3.69.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3406-1.json"}},{"package":{"name":"java-17-openjdk","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","purl":"pkg:rpm/suse/java-17-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.20.0-150400.3.69.1"}]}],"ecosystem_specific":{"binaries":[{"java-17-openjdk-demo":"17.0.20.0-150400.3.69.1","java-17-openjdk-devel":"17.0.20.0-150400.3.69.1","java-17-openjdk-headless":"17.0.20.0-150400.3.69.1","java-17-openjdk":"17.0.20.0-150400.3.69.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3406-1.json"}},{"package":{"name":"java-17-openjdk","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","purl":"pkg:rpm/suse/java-17-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.20.0-150400.3.69.1"}]}],"ecosystem_specific":{"binaries":[{"java-17-openjdk-demo":"17.0.20.0-150400.3.69.1","java-17-openjdk-devel":"17.0.20.0-150400.3.69.1","java-17-openjdk-headless":"17.0.20.0-150400.3.69.1","java-17-openjdk":"17.0.20.0-150400.3.69.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3406-1.json"}},{"package":{"name":"java-17-openjdk","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","purl":"pkg:rpm/suse/java-17-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.20.0-150400.3.69.1"}]}],"ecosystem_specific":{"binaries":[{"java-17-openjdk-demo":"17.0.20.0-150400.3.69.1","java-17-openjdk-devel":"17.0.20.0-150400.3.69.1","java-17-openjdk-headless":"17.0.20.0-150400.3.69.1","java-17-openjdk":"17.0.20.0-150400.3.69.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3406-1.json"}},{"package":{"name":"java-17-openjdk","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","purl":"pkg:rpm/suse/java-17-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.20.0-150400.3.69.1"}]}],"ecosystem_specific":{"binaries":[{"java-17-openjdk-headless":"17.0.20.0-150400.3.69.1","java-17-openjdk":"17.0.20.0-150400.3.69.1","java-17-openjdk-demo":"17.0.20.0-150400.3.69.1","java-17-openjdk-devel":"17.0.20.0-150400.3.69.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3406-1.json"}},{"package":{"name":"java-17-openjdk","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","purl":"pkg:rpm/suse/java-17-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.20.0-150400.3.69.1"}]}],"ecosystem_specific":{"binaries":[{"java-17-openjdk-demo":"17.0.20.0-150400.3.69.1","java-17-openjdk-devel":"17.0.20.0-150400.3.69.1","java-17-openjdk-headless":"17.0.20.0-150400.3.69.1","java-17-openjdk":"17.0.20.0-150400.3.69.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3406-1.json"}},{"package":{"name":"java-17-openjdk","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","purl":"pkg:rpm/suse/java-17-openjdk&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.20.0-150400.3.69.1"}]}],"ecosystem_specific":{"binaries":[{"java-17-openjdk-devel":"17.0.20.0-150400.3.69.1","java-17-openjdk-headless":"17.0.20.0-150400.3.69.1","java-17-openjdk":"17.0.20.0-150400.3.69.1","java-17-openjdk-demo":"17.0.20.0-150400.3.69.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3406-1.json"}}],"schema_version":"1.8.0"}