<div class="container">
<h1>Security update for java-25-openjdk</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:3331-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-07-28T09:36:57Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>important</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1264398">bsc#1264398</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1264994">bsc#1264994</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1267355">bsc#1267355</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272223">bsc#1272223</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272224">bsc#1272224</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272225">bsc#1272225</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272227">bsc#1272227</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272228">bsc#1272228</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272235">bsc#1272235</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272236">bsc#1272236</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272237">bsc#1272237</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-41254.html">CVE-2026-41254</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-46917.html">CVE-2026-46917</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-46968.html">CVE-2026-46968</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-47010.html">CVE-2026-47010</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-47021.html">CVE-2026-47021</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-47027.html">CVE-2026-47027</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-47059.html">CVE-2026-47059</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-47063.html">CVE-2026-47063</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-60147.html">CVE-2026-60147</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-41254</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">2.1</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-41254</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">2.9</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-41254</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-41254</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">4.0</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-46917</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-46917</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-46917</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-46968</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.2</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-46968</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-46968</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-47010</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-47010</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">3.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-47010</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">3.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-47021</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-47021</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-47021</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-47027</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-47027</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-47027</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-47059</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-47059</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">3.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-47059</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">3.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-47063</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-47063</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-47063</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-60147</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-60147</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-60147</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">Basesystem Module 15-SP7</li>
<li class="list-group-item">SUSE Linux Enterprise Desktop 15 SP7</li>
<li class="list-group-item">SUSE Linux Enterprise Real Time 15 SP7</li>
<li class="list-group-item">SUSE Linux Enterprise Server 15 SP7</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 15 SP7</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves nine vulnerabilities and has two security fixes can now be installed.</p>
<h2>Description:</h2>
<p>This update for java-25-openjdk fixes the following issues:</p>
<p>Update to upstream tag jdk-25.0.4+7 (July 2026 CPU).</p>
<p>Security issues fixed:</p>
<ul>
<li>CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in <code>CubeSize</code> (bsc#1264994).</li>
<li>CVE-2026-46917: unauthenticated attacker with network access via TLS can cause a partial denial of service
(bsc#1272223).</li>
<li>CVE-2026-46968: unauthenticated attacker with network access via TLS can gain unauthorized creation, deletion or
modification access to critical data(bsc#1272224).</li>
<li>CVE-2026-47010: unauthenticated attacker with network access via multiple protocols can gain unauthorized update,
insert or delete access to some data (bsc#1272225).</li>
<li>CVE-2026-47021: unauthenticated attacker with network access via multiple protocols can cause a partial denial of
service (bsc#1272227).</li>
<li>CVE-2026-47027: unauthenticated attacker with network access via multiple protocols can cause a partial denial of
service (bsc#1272228).</li>
<li>CVE-2026-47059: unauthenticated attacker with network access via multiple protocols can cause a partial denial of
service (bsc#1272235).</li>
<li>CVE-2026-47063: unauthenticated attacker with network access via multiple protocols can gain unauthorized creation,
deletion or modification access to critical data (bsc#1272236).</li>
<li>CVE-2026-60147: unauthenticated attacker with network access via multiple protocols can gain unauthorized update,
insert, delete and read access to some(bsc#1272237).</li>
</ul>
<p>Other updates and bugfixes:</p>
<ul>
<li>Errors from update-alternatives when installing java-25-openjdk (bsc#1267355).</li>
<li>Make post scripts less noisy (bsc#1267355).</li>
<li>Use libalternatives instead of update-alternatives for distributions where libalternatives is available.</li>
<li>Update to upstream tag jdk-25.0.4+7 (July 2026 CPU): <ul>
<li>JDK-7184899: Test sun/java2d/X11SurfaceData/
/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail</li>
<li>JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes
fails</li>
<li>JDK-8064922: [macos] Test javax/swing/JTabbedPane/4624207/
/bug4624207.java fails</li>
<li>JDK-8068293: [TEST_BUG] Test closed/com/sun/java/swing/plaf/
/motif/InternalFrame/4150591/bug4150591.java fails with
GTKLookAndFeel</li>
<li>JDK-8068310: [TEST_BUG] Test javax/swing/JColorChooser/
/Test4234761.java fails with GTKL&F</li>
<li>JDK-8144124: [macosx] The tabs can't be aligned when we
pressing the key of 'R','B','L','C' or 'T'.</li>
<li>JDK-8203004: UnixMultiResolutionSplashTest.java fails on
Ubuntu16.04</li>
<li>JDK-8213530: Test java/awt/Modal/ToFront/
/DialogToFrontModeless1Test.java fails on Linux</li>
<li>JDK-8221451: PIT: sun/java2d/X11SurfaceData/
/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fails</li>
<li>JDK-8225787: java/awt/Window/GetScreenLocation/
/GetScreenLocationTest.java fails on Ubuntu</li>
<li>JDK-8241066: Shenandoah: fix or cleanup SH::do_full_collection</li>
<li>JDK-8261743: Shenandoah: enable String deduplication with
compact heuristics</li>
<li>JDK-8264851: Shenandoah: Rework control loop mechanics to use
timed waits</li>
<li>JDK-8278102: containers/docker/TestJcmd.java failed with
"RuntimeException: Could not find specified process"</li>
<li>JDK-8279196: Test: jdk/jfr/event/gc/stacktrace/
/TestG1OldAllocationPendingStackTrace.java timed out</li>
<li>JDK-8297191: [macos] Printing a page range with starting
page > 1 results in missing pages</li>
<li>JDK-8298823: [macos] java/awt/Mouse/EnterExitEvents/
/DragWindowTest.java continues to fail with "No MouseReleased
event on label!"</li>
<li>JDK-8319326: GC: Make TestParallelRefProc use
createTestJavaProcessBuilder</li>
<li>JDK-8319540: GC: Make TestSelectDefaultGC use
createTestJavaProcessBuilder</li>
<li>JDK-8321303: Intermittent open/test/jdk/java/awt/
/KeyboardFocusmanager/ConsumeNextMnemonicKeyTypedTest/
/ConsumeNextMnemonicKeyTypedTest.java failure on Linux</li>
<li>JDK-8321687: Test vmTestbase/nsk/jvmti/scenarios/contention/
/TC03/tc03t002/TestDescription.java failed:
JVMTI_ERROR_THREAD_NOT_ALIVE</li>
<li>JDK-8323792: ThreadSnapshot::initialize can cause assert in
Thread::check_for_dangling_thread_pointer (possibility of
dangling Thread pointer)</li>
<li>JDK-8325482: Test that distinct seeds produce distinct traces
for compiler stress flags</li>
<li>JDK-8335355: Shenandoah: Fix race condition in gc/shenandoah/
/mxbeans/TestPauseNotifications.java</li>
<li>JDK-8339526: C2: store incorrectly removed for clone()
transformed to series of loads/stores</li>
<li>JDK-8340182: Java HttpClient does not follow default retry
limit of 3 retries</li>
<li>JDK-8341735: Rewrite the build/AbsPathsInImage.java test to
not load the entire file at once</li>
<li>JDK-8344345: test/hotspot/gtest/x86/x86-asmtest.py has
trailing whitespaces</li>
<li>JDK-8345631: TestRegionSamplingLogging.java
#generational-rotation intermittent fails</li>
<li>JDK-8347167: Reduce allocation in
com.sun.net.httpserver.Headers::normalize</li>
<li>JDK-8347938: Add Support for the Latest ML-KEM and ML-DSA
Private Key Encodings</li>
<li>JDK-8351010: Test java/io/File/GetXSpace.java failed: / usable
space 56380809216 > free space 14912244940</li>
<li>JDK-8352914: Shenandoah: Change definition of
ShenandoahSharedValue to int32_t to leverage platform atomics</li>
<li>JDK-8353115: GenShen: mixed evacuation candidate regions need
accurate live_data</li>
<li>JDK-8354650: [PPC64] Try to reduce register definitions</li>
<li>JDK-8355339: Test java/io/File/GetCanonicalPath.java failed:
The specified network name is no longer available</li>
<li>JDK-8357086: os::xxx functions returning memory size should
return size_t</li>
<li>JDK-8358600: Template-Framework Library: Template for
TestFramework test class</li>
<li>JDK-8358772: Template-Framework Library: Primitive Types</li>
<li>JDK-8359083: Test jdkCheckHtml.java should report
SkippedException rather than report fails when miss tidy</li>
<li>JDK-8359223: HttpClient: Remove leftovers from the
SecurityManager cleanup</li>
<li>JDK-8359412: Template-Framework Library: Operations and
Expressions</li>
<li>JDK-8359433: The final modifier on Windows L&F internal UI
classes prevents extending them in apps</li>
<li>JDK-8361339: Test gc/shenandoah/TestLargeObjectAlignment.java
#generational fails on macOS aarch64 with OOM: Java heap space</li>
<li>JDK-8361606: ConsumeNextMnemonicKeyTypedTest.java fails on
Windows: character typed with VK_A: a</li>
<li>JDK-8361699: C2: assert(can_reduce_phi(n->as_Phi())) failed:
Sanity: previous reducible Phi is no longer reducible before
SUT</li>
<li>JDK-8361726: Shenandoah: More detailed evacuation
instrumentation</li>
<li>JDK-8362428: Update IANA Language Subtag Registry to Version
2025-08-25</li>
<li>JDK-8363943: ARM32: Represent Registers as values</li>
<li>JDK-8363949: Incorrect jtreg header in
MonitorWithDeadObjectTest.java</li>
<li>JDK-8363986: Heap region in CDS archive is not at
deterministic address</li>
<li>JDK-8364315: Remove unused xml files from test/jaxp/javax/xml/
/jaxp/functional/javax/xml/transform/xmlfiles</li>
<li>JDK-8364657: Crash for SecureRandom.generateSeed(0) on Windows
x86-64</li>
<li>JDK-8364927: Add @requires annotation to
TestReclaimStringsLeaksMemory.java</li>
<li>JDK-8365057: Add support for java.util.concurrent lock
information to Thread.dump_to_file</li>
<li>JDK-8365379: SU3.applyInsets may produce wrong results</li>
<li>JDK-8365423: [macos26] java/awt/MenuBar/8007006/
/bug8007006.java fails on macOS 26</li>
<li>JDK-8365424: [macos26] java/awt/Frame/DisposeTest.java fails
on macOS 26</li>
<li>JDK-8365623: test/jdk/sun/security/pkcs11/tls/ tests skipped
without skip exception</li>
<li>JDK-8365625: Can't change accelerator colors in Windows L&F</li>
<li>JDK-8365792: GenShen: assertion "Generations aren't
reconciled"</li>
<li>JDK-8366692: Several gc/shenandoah tests timed out</li>
<li>JDK-8366695: Test sun/jvmstat/monitor/MonitoredVm/
/MonitorVmStartTerminate.java timed out</li>
<li>JDK-8366852: java/awt/Choice/ChoiceMouseWheelTest/
/ChoiceMouseWheelTest.java test is failing</li>
<li>JDK-8367096: jdk/open/test/jdk/sun/security/pkcs11/ rsa, ec,
config, secmod and sslecc tests are skipping but showing as
pass</li>
<li>JDK-8367450: Shenandoah: Log the composition of the collection
set</li>
<li>JDK-8367451: GenShen: Remove the option to compute age census
during evacuation</li>
<li>JDK-8367473: Shenandoah: Make the detailed evacuation metrics
a runtime diagnostic option</li>
<li>JDK-8367485: os::physical_memory is broken in 32-bit JVMs when
running on 64-bit OSes</li>
<li>JDK-8367531: Template Framework: use scopes and tokens instead
of misbehaving immediate-return-queries</li>
<li>JDK-8367646: [GenShen] Control thread may overwrite gc
cancellation cause set by mutator</li>
<li>JDK-8367708: GenShen: Reduce total evacuation burden</li>
<li>JDK-8367709: GenShen: Dirty cards for objects that get
promoted by safepoint that intervenes between allocation and
stores</li>
<li>JDK-8367722: [GenShen] ShenandoahEvacuationStats is always
empty</li>
<li>JDK-8367949: JFR: MethodTrace double-counts methods that catch
their own exceptions</li>
<li>JDK-8368001: java/text/Format/NumberFormat/
/NumberRoundTrip.java timed out</li>
<li>JDK-8368015: Shenandoah: fix error in computation of average
allocation rate</li>
<li>JDK-8368041: Enhance TLS certificate handling</li>
<li>JDK-8368159: Significant performance overhead when started
with jdwp agent and unattached debugger</li>
<li>JDK-8368181: ProblemList java/awt/Dialog/ModalExcludedTest/
/ModalExcludedTest.java</li>
<li>JDK-8368307: Shenandoah: get_next_bit_impl should special case
weak and strong mark bits</li>
<li>JDK-8368499: GenShen: Do not collect age census during evac
when adaptive tenuring is disabled</li>
<li>JDK-8368501: Shenandoah: GC progress evaluation does not use
generation</li>
<li>JDK-8368524: Tests are skipped and shown as passed in test/
/jdk/sun/security/pkcs11/Cipher/KeyWrap</li>
<li>JDK-8368681: Shenandoah: Add documentation comments for
ShenandoahAllocationRate</li>
<li>JDK-8369128: ProblemList jdk/jfr/event/profiling/
/TestCPUTimeSampleQueueAutoSizes.java in Xcomp configs</li>
<li>JDK-8369132: Disable vmTestbase/gc/vector/CircularListLow and
LinearListLow with SerialGC</li>
<li>JDK-8369133: Disable gc/g1/TestShrinkAuxiliaryDataRunner.java
with UseLargePages option</li>
<li>JDK-8369251: Opensource few tests</li>
<li>JDK-8369561: sun/java2d/OpenGL/DrawBitmaskImage.java#id0:
Incorrect color for first pixel (actual=ff000000)</li>
<li>JDK-8369683: Exclude runtime/Monitor/
/MonitorWithDeadObjectTest.java#DumpThreadsBeforeDetach on
Alpine Linux debug</li>
<li>JDK-8369736: Add management interface for AOT cache creation</li>
<li>JDK-8369817: [TESTBUG] EmptyPath::toString is ignored</li>
<li>JDK-8369912: [TESTBUG] testlibrary_tests/template_framework/
/examples/TestExpressions.java fails with ArithmeticException:
/ by zero - forgot to respect Expression.info</li>
<li>JDK-8369950: TLS connection to IPv6 address fails with BCJSSE
due to IllegalArgumentException</li>
<li>JDK-8370370: Add still more cases to WorstCaseTests</li>
<li>JDK-8370489: Some compiler tests miss the @key randomness</li>
<li>JDK-8370502: C2: segfault while adding node to IGVN worklist</li>
<li>JDK-8370521: GenShen: Various code cleanup related to
promotion</li>
<li>JDK-8370939: C2: SIGSEGV in SafePointNode::verify_input when
processing MH call from
Compile::process_late_inline_calls_no_inline()</li>
<li>JDK-8371284: GenShen: Avoid unnecessary card marking</li>
<li>JDK-8371381: [Shenandoah] Setting ergo flags should use
FLAG_SET_ERGO</li>
<li>JDK-8371503: RETAIN_IMAGE_AFTER_TEST do not work for some
tests</li>
<li>JDK-8371792: Refactor barrier loop tests out of TestIfMinMax</li>
<li>JDK-8371893: [macOS] use dead_strip linker option to reduce
binary size</li>
<li>JDK-8372272: Hotspot shared lib loading - add load attempts to
Events::log</li>
<li>JDK-8372351: Add 2 WISeKey roots</li>
<li>JDK-8372380: Make hs_err reporting more robust for unattached
threads</li>
<li>JDK-8372513: Shenandoah: ShenandoahMaxRegionSize can produce
an unaligned heap alignment</li>
<li>JDK-8372851: Modify java/io/File/GetXSpace.java to print path
on failure of native call</li>
<li>JDK-8372861: Genshen: Override parallel_region_stride of
ShenandoahResetBitmapClosure to a reasonable value for better
parallelism</li>
<li>JDK-8373039: Remove Incorrect Asserts in
shenandoahScanRemembered</li>
<li>JDK-8373120: Virtual thread stuck in BLOCKED state</li>
<li>JDK-8373239: Test java/awt/print/PrinterJob/PageRanges.java
fails with incorrect selection of printed pages</li>
<li>JDK-8373275: Improve DTLS handshaking</li>
<li>JDK-8373515: Migrate "test/jdk/java/net/httpclient/" to
null-safe "SimpleSSLContext" methods</li>
<li>JDK-8373579: Problem list compiler/runtime/Test7196199.java</li>
<li>JDK-8373650: Test "javax/swing/JMenuItem/6458123/
/ManualBug6458123.java" fails because the check icons are not
aligned properly as expected</li>
<li>JDK-8373676: Test javax/net/ssl/HttpsURLConnection/
/SubjectAltNameIP.java fails on a machine without IPV6</li>
<li>JDK-8373690: Unexpected Keystore message using
jdk.crypto.disabledAlgorithms</li>
<li>JDK-8373714: Shenandoah: Register heuristic penalties
following a degenerated GC</li>
<li>JDK-8373718: jdk/internal/misc/VM/RuntimeArguments.java test
fails in Virtual threads mode</li>
<li>JDK-8373796: Refactor java/net/httpclient/
/ThrowingPublishers*.java tests to use JUnit5</li>
<li>JDK-8373847: Test javax/swing/JMenuItem/MenuItemTest/
/bug6197830.java failed because The test case automatically
fails when clicking any items in the “Nothing” menu in all
four windows (Left-to-right)-Menu Item Test and
(Right-to-left)-Menu Item Test</li>
<li>JDK-8373866: Refactor java/net/httpclient/
/ThrowingSubscribers*.java tests to use JUnit5</li>
<li>JDK-8373893: Refactor networking http server tests to use
JUnit</li>
<li>JDK-8373913: Refactor serialization tests to use JUnit</li>
<li>JDK-8373928: 4 Dangling pointer defect groups in java.c</li>
<li>JDK-8374001: sun/security/ skip without Exceptions</li>
<li>JDK-8374058: Enhance JPEG handling</li>
<li>JDK-8374168: Resolve disabled warnings in JDWP agent</li>
<li>JDK-8374304: MultiResolutionSplashTest.java fails in CI:
"Image with wrong resolution is used for splash screen!"</li>
<li>JDK-8374322: TestMemoryWithSubgroups.java fails Permission
denied</li>
<li>JDK-8374343: Fix SIGSEGV when lib/modules is unreadable</li>
<li>JDK-8374449: Shenandoah: Leaf locks used by Shenandoah need
lower ranks</li>
<li>JDK-8374506: Incorrect positioning of arrow icon in parent
JMenu in Windows L&F</li>
<li>JDK-8374712: AOTMappedHeapWriter::relocate_field_in_buffer
should use CompressedOops::narrow_oop_cast</li>
<li>JDK-8374727: Audio configuration Platform class - use nio for
getting endianness of the underlying platform</li>
<li>JDK-8374744: Enable dumping of APX EGPRs (R16–R31) in JVM
fatal error logs</li>
<li>JDK-8374769: PPC: MASM::pop_cont_fastpath() should reset
_cont_fastpath if SP == _cont_fastpath</li>
<li>JDK-8374888: Implement internal test cache to help
UserIterCount test performance</li>
<li>JDK-8374998: Failing os::write - remove bad file</li>
<li>JDK-8375065: Update LCMS to 2.18</li>
<li>JDK-8375177: Gtest
os_linux.decoder_get_source_info_valid_vm fails with
-ffunction-sections</li>
<li>JDK-8375294: (fs) Files.copy can fail with EOPNOTSUPP when
copy_file_range not supported</li>
<li>JDK-8376031: HttpsURLConnection.getServerCertificates() throws
"java.lang.IllegalStateException: connection not yet open" for
the HEAD method</li>
<li>JDK-8376104: C2 crashes in PhiNode::Ideal(PhaseGVN*, bool)
accessing NULL pointer</li>
<li>JDK-8376151: Test javax/swing/JFileChooser/4966171/
/bug4966171.java is failing with OOME</li>
<li>JDK-8376152: Test javax/sound/sampled/Clip/bug5070081.java
timed out then completed</li>
<li>JDK-8376185: NoSuchFieldError thrown after a record with type
annotation retransformed</li>
<li>JDK-8376233: Clean up code in Desktop native peer</li>
<li>JDK-8376287: Crashes when using -XX:ObjArrayMarkingStride=0</li>
<li>JDK-8376402: Dependencies::print_statistics() and
AbstractClassHierarchyWalker::print_statistics() are not
called from PRODUCT code</li>
<li>JDK-8376684: Compile OpenJDK in headless mode without required
X11 libraries</li>
<li>JDK-8376956: Add JVMTI phase entering/setting to hserr event
log</li>
<li>JDK-8376969: Shenandoah: GC state getters should be inlineable</li>
<li>JDK-8376970: Shenandoah: Verifier should do basic verification
before touching oops</li>
<li>JDK-8377158: Enhance XBM image support</li>
<li>JDK-8377167: javax/imageio/ReadAbortTest.java throw NPE when
x11 unavailable</li>
<li>JDK-8377498: Improve HttpServer handling</li>
<li>JDK-8377512: AOT cache creation fails with invalid native
pointer</li>
<li>JDK-8377602: Create automated test for PageRange</li>
<li>JDK-8377727: Ghost caret and focus appear in non‑editable
text fields</li>
<li>JDK-8377833: Enhance Jar file processing</li>
<li>JDK-8377907: (process) Race in ProcessBuilder can cause JVM
hangs</li>
<li>JDK-8377910: Minor cleanup of java/io/FileDescriptor/
/Sharing.java</li>
<li>JDK-8377932: AOT cache is not rejected when JAR file has
changed</li>
<li>JDK-8377944: LowMemoryTest2.java#id1 intermittent fails OOME:
Metaspace</li>
<li>JDK-8377949: TestZRelocationSetEvent.java intermittent fails
OOME</li>
<li>JDK-8378083: Mark shenandoah/generational/
/TestOldGrowthTriggers.java as flagless</li>
<li>JDK-8378201: [OGL] glXMakeContextCurrent() drops the buffers
of the unbound drawable</li>
<li>JDK-8378417: Printing All pages results in NPE for 1.1
PrintJob</li>
<li>JDK-8378561: Mark gc/shenandoah/compiler/
/TestLinkToNativeRBP.java as /native</li>
<li>JDK-8378687: Improve delegation of HttpURLConnection</li>
<li>JDK-8378727: [macOS] Missing dispatch_release for semaphores
in CDesktopPeer</li>
<li>JDK-8378746: ZGC: jdk/jfr/event/gc/detailed/
/TestZRelocationSetGroupEvent.java intermittent OOME</li>
<li>JDK-8378764: fileStream::fileSize() fails for >2GB files on
Windows</li>
<li>JDK-8378774: Bump update version for OpenJDK: jdk-25.0.4</li>
<li>JDK-8378810: Enable missing FFM test via jtreg requires for
RISC-V</li>
<li>JDK-8378836: Enable linktime-gc by default on Linux ppc64le</li>
<li>JDK-8378878: Refactor java/nio/channels/
/AsynchronousSocketChannel test to use JUnit</li>
<li>JDK-8378888: jdk/incubator/vector/
/Float16OperationsBenchmark.java uses wrong package name</li>
<li>JDK-8379021: Shenandoah: Speedup ShenandoahSimpleBitMapTest</li>
<li>JDK-8379202: Support linktime-gc on Linux with clang</li>
<li>JDK-8379416: AIX build fails if system (not GNU) date tool is
in PATH</li>
<li>JDK-8379425: Windows and macOS should not allow unsupported
headless-only build</li>
<li>JDK-8379457: Test EATests.java#id0 ERROR: monitor list errors:
error_cnt=1</li>
<li>JDK-8379464: Enable missing stack walking test via jtreg
requires for RISC-V</li>
<li>JDK-8379499: [AIX] headless-only build of libjawt.so fails</li>
<li>JDK-8379515: draft-ietf-lamps-kyber-certificates is now
RFC 9935</li>
<li>JDK-8380011: Path-to-gcroots search should not trigger stack
overflows</li>
<li>JDK-8380041: PPC: remove POWER6 remnants</li>
<li>JDK-8380222: Refactor test/jdk/java/lang/Character TestNG
tests to JUnit</li>
<li>JDK-8380316: Test runtime/os/AvailableProcessors.java fails
Invalid argument</li>
<li>JDK-8380409: JVM crashes when -XX:AOTMode=create uses
app.aotconf generated with JVMTI agent</li>
<li>JDK-8380428: ProblemList containers/docker/
/TestJcmdWithSideCar.java on linux-all</li>
<li>JDK-8380431: Shenandoah: Concurrent modification of
stack-chunk objects during evacuation</li>
<li>JDK-8380474: Crash SEGV in ThreadIdTable::lazy_initialize
after JDK-8323792</li>
<li>JDK-8380565: PPC64: deoptimization stub should save vector
registers</li>
<li>JDK-8380663: Update jcmd man page to include AOT.end_recording
diagnostic command</li>
<li>JDK-8380672: Improve certification checking</li>
<li>JDK-8380846: GenShen: Remove the experimental option to
disable adaptive tenuring</li>
<li>JDK-8380947: Add pull request template</li>
<li>JDK-8381039: Enhance AWT ImagingLib</li>
<li>JDK-8381049: Enhance Jar handling</li>
<li>JDK-8381205: GHA: Upgrade Node.js 20 to 24</li>
<li>JDK-8381315: compiler/vectorapi/TestVectorReallocation.java
fails with -XX:UseAVX=1 after JDK-8380565</li>
<li>JDK-8381382: Shenandoah: assert(capacity > 0) failed: free
regions must have allocation capacity</li>
<li>JDK-8381519: Enhance Der Value Handling</li>
<li>JDK-8381796: Enhance Certificate parsing</li>
<li>JDK-8381871: GenShen: ShenandoahGCHeuristics flag not reset
after ignoring non-adaptive value</li>
<li>JDK-8381935: Improve numChunks range in the PPC64 CallAranger</li>
<li>JDK-8381937: Make exceptions in
Java_sun_security_mscapi_CKeyPairGenerator generateCKeyPair
more specific</li>
<li>JDK-8382018: test/jdk/java/nio/file/spi/
/SetDefaultProvider.java leaves a directory in /tmp</li>
<li>JDK-8382020: Time Zone Abbreviation Not Localized for
Non-English Locales</li>
<li>JDK-8382035: [ubsan] Under UBSAN builds, disable tests that
rely on simulated JVM crashes</li>
<li>JDK-8382090: Remove .rej and .orig from .gitignore</li>
<li>JDK-8382242: JFR: Metadata reconstruction invalidates
ConstantMap for java.lang.String</li>
<li>JDK-8382295: Shenandoah: wrong denominator in full gc summary</li>
<li>JDK-8382395: Disable stringop-overflow in
shenandoahGenerationalHeap.cpp</li>
<li>JDK-8382419: Add missed @key randomness after JDK-8370489</li>
<li>JDK-8382522: Disable stringop-overflow in
safepointMechanism.cpp</li>
<li>JDK-8382740: JFR: Disable jdk.OldObjectSample event for
generational ZGC</li>
<li>JDK-8382878: RISC-V: Missing InlineSkippedInstructionsCounter
in ZGC barriers stubs</li>
<li>JDK-8382932: [25u] Test java/lang/instrument/
/RetransformRecordTypeAnn/TestRetransformRecord.java fails
with compilation error</li>
<li>JDK-8383161: [PPC64]
MachCallDynamicJavaNode::ret_addr_offset() needs adaptation
for COH</li>
<li>JDK-8383175: (tz) Update Timezone Data to 2026b</li>
<li>JDK-8383183: Shenandoah: Mangle trashed regions up to top
instead of end</li>
<li>JDK-8383354: Update LCMS to 2.19.1</li>
<li>JDK-8383473: Follow on from tzdata2026b time change to
include temporary hack BC time change</li>
<li>JDK-8383601: RISC-V:
ShenandoahBarrierSetAssembler::load_reference_barrier calls
"weak" on "phantom" path</li>
<li>JDK-8383630: Fix iteration in tests doing class redefinition</li>
<li>JDK-8384043: [REDO] Incorrect handling of Hawaii_Aleutian
metazone</li>
<li>JDK-8384158: GHA: Downgrade Windows GHA runners to
windows-2022 temporarily</li>
<li>JDK-8384163: (so) SocketChannel.connect and finishConnect()
exception messages could be improved</li>
<li>JDK-8384223: RISC-V: entry_barrier_offset should consider
UseZtso</li>
<li>JDK-8384486: NTLM tests fail on Windows 11 and Windows Server
2025</li>
<li>JDK-8384495: Update Libpng to 1.6.58</li>
<li>JDK-8384540: [25u, 21u, 17u] Update GHA JDKs after Apr/26
updates</li>
<li>JDK-8384815: SelectOneKeyOutOfMany and PreferredKey fail after
expired test certificate</li>
<li>JDK-8384902: Update GIFlib to 6.1.3</li>
<li>JDK-8385390: Update FreeType to 2.14.3</li>
<li>JDK-8385490: Update HarfBuzz to 14.2.0</li>
<li>JDK-8386551: Windows build broken because of MSys2/Make update</li>
</ul>
</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
Basesystem Module 15-SP7
<br/>
<code>zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-3331=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64)
<ul>
<li>java-25-openjdk-devel-25.0.4.0-150700.15.13.1</li>
<li>java-25-openjdk-headless-25.0.4.0-150700.15.13.1</li>
<li>java-25-openjdk-demo-25.0.4.0-150700.15.13.1</li>
<li>java-25-openjdk-debuginfo-25.0.4.0-150700.15.13.1</li>
<li>java-25-openjdk-devel-debuginfo-25.0.4.0-150700.15.13.1</li>
<li>java-25-openjdk-headless-debuginfo-25.0.4.0-150700.15.13.1</li>
<li>java-25-openjdk-25.0.4.0-150700.15.13.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-41254.html">https://www.suse.com/security/cve/CVE-2026-41254.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-46917.html">https://www.suse.com/security/cve/CVE-2026-46917.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-46968.html">https://www.suse.com/security/cve/CVE-2026-46968.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-47010.html">https://www.suse.com/security/cve/CVE-2026-47010.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-47021.html">https://www.suse.com/security/cve/CVE-2026-47021.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-47027.html">https://www.suse.com/security/cve/CVE-2026-47027.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-47059.html">https://www.suse.com/security/cve/CVE-2026-47059.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-47063.html">https://www.suse.com/security/cve/CVE-2026-47063.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-60147.html">https://www.suse.com/security/cve/CVE-2026-60147.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1264398">https://bugzilla.suse.com/show_bug.cgi?id=1264398</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1264994">https://bugzilla.suse.com/show_bug.cgi?id=1264994</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1267355">https://bugzilla.suse.com/show_bug.cgi?id=1267355</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272223">https://bugzilla.suse.com/show_bug.cgi?id=1272223</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272224">https://bugzilla.suse.com/show_bug.cgi?id=1272224</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272225">https://bugzilla.suse.com/show_bug.cgi?id=1272225</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272227">https://bugzilla.suse.com/show_bug.cgi?id=1272227</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272228">https://bugzilla.suse.com/show_bug.cgi?id=1272228</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272235">https://bugzilla.suse.com/show_bug.cgi?id=1272235</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272236">https://bugzilla.suse.com/show_bug.cgi?id=1272236</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1272237">https://bugzilla.suse.com/show_bug.cgi?id=1272237</a>
</li>
</ul>
</div>