The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6037 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6037-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     October 24, 2025                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : openjdk-21     CVE ID         : CVE-2025-53057 CVE-2025-53066 CVE-2025-61748

    Several vulnerabilities have been discovered in the OpenJDK Java     runtime, which may result in incorrect string equality checks, XML     XXE/XEE attacks or incorrect certificate validation.

    For the stable distribution (trixie), these problems have been fixed in     version 21.0.9+10-1~deb13u1.

    We recommend that you upgrade your openjdk-21 packages.

    For the detailed security status of openjdk-21 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openjdk-21

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:18814 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * JDK: Enhance Path Factories (CVE-2025-53066)

    * JDK: Enhance Certificate Handling (CVE-2025-53057)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Amazon Corretto installed on the remote host is 8 prior to 8.472.08.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-8-2025-Oct-21 advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion     or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2025-53057)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical     data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g.,     through a web service which supplies data to the APIs. This vulnerability also applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2025-53066)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 8u461, 11.0.28, 17.0.16, 21.0.8, 25, versions of Java installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory.

  - Vulnerability in Oracle Java SE (component: JavaFX (WebKitGTK)). Supported versions that are affected are     Oracle Java SE: 8u461-b50. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human     interaction from a person other than the attacker. Successful attacks of this vulnerability can result in     takeover of Oracle Java SE. (CVE-2025-31257)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation,     deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition accessible data. (CVE-2025-53057)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product     of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle     GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access     to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. (CVE-2025-53066)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-18821 advisory.

    [1:17.0.17.0.10-1.0.1]
    - Add Oracle vendor bug URL [Orabug: 34340155]

    [1:17.0.17.0.10-1]
    - Update to jdk-17.0.17+10 (GA)
    - Add to .gitignore openjdk-17.0.17+10.tar.xz
    - Set buildver to 10
    - Set rpmrelease to 1, remove 'must start at 2' comment
    - Set is_ga to 1
    - Update sources to openjdk-17.0.17+10.tar.xz
    - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
    - Resolves: RHEL-119449
    - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. **

    [1:17.0.17.0.7-0.2.ea]
    - Update to jdk-17.0.17+7 (EA)
    - Add to .gitignore openjdk-17.0.17+7-ea.tar.xz
    - Set updatever to 17
    - Set buildver to 7
    - Set is_ga to 0
    - Update sources to openjdk-17.0.17+7-ea.tar.xz
    - Set bundled harfbuzz version to 11.2.0
    - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-18824 advisory.

    [1:21.0.9.0.10-1.0.1]
    - Add Oracle vendor bug URL [Orabug: 34340155]

    [1:21.0.9.0.10-1]
    - Update to jdk-21.0.9+10 (GA)
    - Update release notes to 21.0.9+10
    - Bump harfbuzz version to 11.2.0 following JDK-8355528
    - Add NEWS corrections from Thomas
    - Use double spacing consistently in notes for this release
    - Correct 11u release reference to corresponding 21u release as pointed out by Kieran
    - Sync the copy of the portable specfile with the latest update
    - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. **
    - Resolves: RHEL-118773
    - Resolves: RHEL-119450

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Amazon Corretto installed on the remote host is 11 prior to 11.0.29.7.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-11-2025-Oct-21 advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion     or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2025-53057)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical     data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g.,     through a web service which supplies data to the APIs. This vulnerability also applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2025-53066)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Azul Zulu installed on the remote host is 6 prior to 6.75.0.14 / 7 prior to 7.81.0.12 / 8 prior to 8.89.0.14 / 11 prior to 11.83.12 / 17 prior to 17.61.12 / 21 prior to 21.45.14 / 25 prior to 25.29.12. It is, therefore, affected by multiple vulnerabilities as referenced in the 2025-10-21 advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical     data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g.,     through a web service which supplies data to the APIs. This vulnerability also applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2025-53066)

  - This issue was addressed with improved memory handling. This issue is fixed in watchOS 11.5, tvOS 18.5,     iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, visionOS 2.5, Safari 18.5. Processing maliciously crafted     web content may lead to an unexpected Safari crash. (CVE-2025-31257)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion     or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2025-53057)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and     25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. (CVE-2025-61748)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-18815 advisory.

    [1:1.8.0.472.b08-1.0.1]
    - Add Oracle vendor bug URL [Orabug: 34340155]

    [1:1.8.0.472.b08-1]
    - Update to 8u472-b08 (GA).
    - Update release notes for 8u472-b08.
    - Drop local JDK-8339414 fix as this is now included upstream
    - Reset rpmrelease to 1 now there are no other RPM builds on RHEL 9
    - Sync the copy of the portable specfile with the latest update
    - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. **
    - Resolves: RHEL-118767
    - Resolves: RHEL-119455

    [1:1.8.0.462.b08-5]
    - Update get_bundle_versions.sh to match other scripts
    - * get_bundle_versions.sh: Add license
    - * get_bundle_versions.sh: Set compile-command in Emacs
    - * get_bundle_versions.sh: Use different error codes for different failures
    - * get_bundle_versions.sh: Remove unneeded '.' in JPEG version
    - * get_bundle_versions.sh: shellcheck: Double-quote variable references (SC2086)
    - * get_bundle_versions.sh: shellcheck: Drop use of cat and pass file to awk directly (SC2002)
    - Add OpenJDK 8u support to get_bundle_versions.sh
    - Print bundle updates and backouts at end of openjdk_news.sh output
    - Refer user to get_bundle_versions.sh when bundle updates are found by openjdk_news.sh
    - Add timezone data update check to openjdk_news.sh
    - Add duplicate check to openjdk_news.sh
    - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh
    - Sync the copy of the portable specfile with the latest update
    - Resolves: RHEL-119329

    [1:1.8.0.462.b08-5]
    - Add script to obtain bundled library versions from OpenJDK sources
    - Related: RHEL-119329

    [1:1.8.0.462.b08-5]
    - Warn about bundled provide version bumps and backouts in openjdk_news.sh
    - Related: RHEL-119329

    [1:1.8.0.462.b08-5]
    - Bump rpmrelease for move to portables only on RHEL 8
    - Resolves: RHEL-118775

    [1:1.8.0.462.b08-4]
    - Bump rpmrelease for CentOS build
    - Remove obsolete hack to hardcode newer portable version on RHEL
    - Related: RHEL-101648
    - Related: RHEL-102312
    - Related: RHEL-97496

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Amazon Corretto installed on the remote host is 17 prior to 17.0.17.10.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-17-2025-Oct-21 advisory.

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion     or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2025-53057)

  - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical     data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g.,     through a web service which supplies data to the APIs. This vulnerability also applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2025-53066)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:18821 advisory.

    The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java     Software Development Kit.

    Security Fix(es):

    * JDK: Enhance Path Factories (CVE-2025-53066)

    * JDK: Enhance Certificate Handling (CVE-2025-53057)

    Bug Fix(es):

    * Since the 8.8 release of Red Hat Enterprise Linux 8 and the 9.2 release of Red Hat Enterprise Linux 9,     OpenJDK 17 has used a single build repackaged for each major Red Hat Enterprise Linux release.  With this     release, this same build is now also used by the following older releases: 8.4, 8.6 and 9.0 (RHEL-118788,     RHEL-118789, RHEL-118792)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:18815 advisory.

    The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java     Software Development Kit.

    Security Fix(es):

    * JDK: Enhance Path Factories (CVE-2025-53066)

    * JDK: Enhance Certificate Handling (CVE-2025-53057)

    Bug Fix(es):

    * Since the 8.8 release of Red Hat Enterprise Linux 8 and the 9.2 release of Red Hat Enterprise Linux 9,     OpenJDK 8 has used a single build repackaged for each major Red Hat Enterprise Linux release.  With this     release, this same build is now also used by the following older releases: 8.2, 8.4, 8.6, and 9.0. On Red     Hat Enterprise Linux 8.2 systems, this means that OpenJDK's FIPS mode will now be enabled by default when     the system is in FIPS mode. To revert to the previous behaviour, use -Dcom.redhat.fips=false (RHEL-118777,     RHEL-118778, RHEL-118779, RHEL-118782)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:18824 advisory.

    The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software     Development Kit.

    Security Fix(es):

    * JDK: Enhance Path Factories (CVE-2025-53066)

    * JDK: Enhance Certificate Handling (CVE-2025-53057)

    * JDK: Enhance String Handling (CVE-2025-61748)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:18818 advisory.

    The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java     Software Development Kit.

    This release contains OpenJDK 11 with Extended Lifecycle Support for Red Hat Enterprise Linux versions 7,     8, and 9.

    Security Fix(es):

    * JDK: Enhance Path Factories (CVE-2025-53066)

    * JDK: Enhance Certificate Handling (CVE-2025-53057)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
271418	Debian dsa-6037 : openjdk-21-dbg - security update	Nessus	Debian Local Security Checks	10/24/2025	10/24/2025	high
271221	RHEL 7 : java-1.8.0-openjdk (RHSA-2025:18814)	Nessus	Red Hat Local Security Checks	10/23/2025	10/24/2025	high
271093	Amazon Corretto Java 8.x < 8.472.08.1 Multiple Vulnerabilities	Nessus	Misc.	10/21/2025	10/21/2025	medium
271249	Oracle Java SE Multiple Vulnerabilities (October 2025 CPU)	Nessus	Misc.	10/23/2025	10/24/2025	high
271414	Oracle Linux 8 / 9 : java-17-openjdk (ELSA-2025-18821)	Nessus	Oracle Linux Local Security Checks	10/24/2025	10/24/2025	high
271416	Oracle Linux 10 / 8 / 9 : java-21-openjdk (ELSA-2025-18824)	Nessus	Oracle Linux Local Security Checks	10/24/2025	10/24/2025	high
271095	Amazon Corretto Java 11.x < 11.0.29.7.1 Multiple Vulnerabilities	Nessus	Misc.	10/21/2025	10/21/2025	medium
271096	Azul Zulu Java Multiple Vulnerabilities (2025-10-21)	Nessus	Misc.	10/21/2025	10/21/2025	high
271419	Oracle Linux 8 / 9 : java-1.8.0-openjdk (ELSA-2025-18815)	Nessus	Oracle Linux Local Security Checks	10/24/2025	10/24/2025	high
271094	Amazon Corretto Java 17.x < 17.0.17.10.1 Multiple Vulnerabilities	Nessus	Misc.	10/21/2025	10/21/2025	medium
271219	RHEL 8 / 9 : java-17-openjdk (RHSA-2025:18821)	Nessus	Red Hat Local Security Checks	10/23/2025	10/24/2025	high
271273	RHEL 8 / 9 : java-1.8.0-openjdk (RHSA-2025:18815)	Nessus	Red Hat Local Security Checks	10/23/2025	10/24/2025	high
271222	RHEL 10 / 8 / 9 : java-21-openjdk (RHSA-2025:18824)	Nessus	Red Hat Local Security Checks	10/23/2025	10/24/2025	high
271267	RHEL 7 / 8 / 9 : java-11-openjdk ELS (RHSA-2025:18818)	Nessus	Red Hat Local Security Checks	10/23/2025	10/24/2025	high

Detections

Analytics

Plugins Search

high

high

medium

high

high

high

medium

high

high

medium

high

high

high

high