Serguey Asael Shinder: The same three CVEs landed again, this time against OpenJDK 21
Canonical published USN-8796-1 on 21 September 2026, fixing several security issues in OpenJDK 21. The affected package is openjdk-21, and the listed releases are Ubuntu 26.04 LTS, 24.04 LTS, 22.04 LTS and 20.04 LTS.
The three issues are the ones already familiar from the OpenJDK 17 notice, and the notice describes all three as incorrect handling of user authentication, remotely triggerable:
- CVE-2026-61308 — the Networking component; a remote attacker could possibly leak sensitive information. Credited to Kai Aizen.
- CVE-2026-70907 — the JSSE component; a remote attacker could possibly cause a denial of service.
- CVE-2026-60589 — the Security component; a remote attacker could possibly leak sensitive information.
The part worth noticing
The interesting thing is not the flaws, which were already described. It is that the same three identifiers arrive twice, against two JDK lines, on two different release matrices.
The OpenJDK 17 notice reached back through 16.04 and 14.04 LTS, which sit in Expanded Security Maintenance. This OpenJDK 21 notice reaches forward instead, to 26.04 and 24.04, and stops at 20.04. The union of the two is wider than either, and no single line of the matrix tells you whether a given machine is covered.
For a fleet, the practical consequence is that "we patched the OpenJDK CVEs" is not a statement that can be true on its own. It has to be qualified twice — by which JDK major version a host runs, and by which Ubuntu release it runs on — because the same CVE number is fixed by different packages in different notices, on different dates.
The estate that is hardest to answer for is the one running both 17 and 21, which in practice is most of them: a build agent on one, a long-lived service on the other. Two package names, two notices, one set of CVE identifiers in the report that management reads.
⚠️ There is no JDK on the machine this was written on, so nothing here is a test result. The identifiers, components, credits and release lists are taken from the notice itself, and the notice's own Update instructions section is the place to take the commands from.