OpenJDK October update fixes 46 CVEs; Corretto builds are out

OpenJDK October update fixes 46 CVEs; Corretto builds are out

22 October 2026: The OpenJDK project's quarterly vulnerability advisory fixes 46 CVEs in the JDK and six in OpenJFX. The highest-rated JDK flaw is CVE-2026-91415 in the 2D graphics libraries, at CVSS 7.0, and none is rated critical. A second advisory a day later added CVE-2026-91403, a 9.1-rated flaw in the TLS implementation. Amazon Corretto, Amazon's free OpenJDK distribution, shipped its matching updates on 22 October.

Not yet independently verified. OpenJDK publishes scores and components but no descriptions for each CVE, and Amazon does not map CVEs to its Corretto builds, so which flaw each build closes is inferred from the version numbers. We will update this when it can be confirmed, and remove this note.

Which releases need the update

OpenJDK lists 26.0.2.1, 25.0.4.1, 21.0.12.1, 17.0.20.1, 11.0.32.1, 8u504 and earlier as affected, and its risk matrix marks most flaws in every line it tracks, from 8 to 27. Corretto's new builds are:

Line	Corretto build
27	27.0.1.0.10
25	25.0.5.0.9
21	21.0.13.0.10
17	17.0.21.0.10
11	11.0.33.0.9
8	8u512

They are available from Amazon's download page and from its apt, yum and apk repositories. Other OpenJDK distributions publish their own builds on their own schedules, so a team running Temurin, Zulu or a Linux vendor's package should check that vendor's notes rather than assume the Corretto numbers.

The flaws at the top of the list

Behind CVE-2026-91415 come CVE-2026-91398 in java.net at 6.8, and a group rated 6.5 across 2D graphics, Kerberos (org.ietf.jgss), java.net, java.security and JAR handling. Several of the 6.5 and 5.3 entries in java.net and java.util.jar can be reached over a network without authentication, which makes them the ones that matter for servers that parse untrusted input or fetch remote resources. In OpenJFX, CVE-2026-43660 in the WebView component scores 7.5.

OpenJDK's matrix gives only the component and score for each CVE, without a description, and notes that defence-in-depth fixes get no CVE at all.

The separate TLS fix

CVE-2026-91403, published in OpenJDK's 21 October advisory, affects the javax.net.ssl component in every line from 8 to 27 and is rated 9.1. It is the same flaw as in Oracle's out-of-band Java SE alert, which we covered in Oracle's Java SE security alert; the advisory points to OpenJDK's guidance on the eMudhra certificate distrust. Teams that patched to the regular October builds early should confirm that their distribution's build also includes that fix, as Oracle's own customers had to patch twice.

Sources

• OpenJDK Vulnerability Advisory: 2026/10/20, 20 October 2026
• OpenJDK Vulnerability Advisory: 2026/10/21, 21 October 2026
• AWS What's New: Amazon Corretto October 2026 quarterly updates, 23 October 2026