Java’s trust in eMudhra’s compromised certificate authorities now has a fix
- Affected
- Java SE and GraalVM versions Oracle supports, OpenJDK
27.0.1,25.0.5,21.0.13,17.0.21,11.0.33,8u512and earlier, and older Node.js releases. All versions and fixes
- CVE
- Vendors
- Oracle, eMudhra
Oracle and OpenJDK released fixes on Oct 21 for , a Java flaw that OpenJDK says concerns eMudhra’s eight compromised intermediate certificate authorities. Their private keys can be recovered from the certificates, and the incident site says an attacker holding one could impersonate any website or service. Oracle rates the flaw 9.1 and says it can be exploited over a network without credentials. OpenJDK says standalone runtimes likely contain the compromised certificates.
Oracle lists Java SE, GraalVM for JDK and GraalVM Enterprise Edition as affected. It says the flaw is in JSSE, the component behind javax.net.ssl, and can be exploited through its APIs, for example by a web service that supplies them data. Oracle’s alert points to its patch availability documents for the fixed releases. On the 8 branch, OpenJDK lists 8u512 and earlier as affected, while Oracle lists 8u511.
OpenJDK says the Java packages in Arch Linux, Debian, Devuan, Fedora, Gentoo, Oracle Linux, Red Hat Enterprise Linux and Ubuntu most likely use the operating system’s certificates. For those, it says, updating the operating system’s certificates is enough. The OpenJDK packages in FreeBSD and Homebrew must be updated directly. For runtimes that can’t be updated yet, it publishes a new blocklist file and gives settings that turn on revocation checking.
The incident site says the keys could have been recovered since the certificates were created in April 2025. Firefox and Chrome have blocked the intermediates since Oct 17, Apple devices since Oct 19 and Microsoft platforms since Oct 20. Clients that don’t use revocation data need software updates instead, the site says. The site says it isn’t known whether attackers used the keys against such clients.
Node.js 22.23.4, released Oct 21, updates its bundled root certificates to those in NSS 3.131.1, its release notes say. The incident site lists 24.22.1 and 26.12.1 as patched too. Neither Oracle nor OpenJDK has said whether anyone has exploited .
- CVE
- Vendors
- Oracle, eMudhra
What to do
7 steps
Affected and fixed versions
| Product | Affected | Fixed |
|---|---|---|
| Oracle Java SE | 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1 | Oracle’s Oct 21 Security Alert patches |
| Oracle GraalVM for JDK | 17.0.21 and 21.0.13 | Oracle’s Oct 21 Security Alert patches |
| Oracle GraalVM Enterprise Edition | 21.3.20 | Oracle’s Oct 21 Security Alert patches |
| OpenJDK, standalone runtimes | 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33, 8u512 and earlier | Updated runtimes from each provider |
| OpenJDK from Linux distributions | Most use the operating system’s certificates, OpenJDK says | Updated operating system certificates |
| Node.js | Earlier releases | 22.23.4, 24.22.1 or 26.12.1 |
- Product
- Oracle Java SE
- Affected
8u511,11.0.33,17.0.21,21.0.13,25.0.5and27.0.1- Fixed
- Oracle’s Oct 21 Security Alert patches
- Product
- Oracle GraalVM for JDK
- Affected
17.0.21and21.0.13- Fixed
- Oracle’s Oct 21 Security Alert patches
- Product
- Oracle GraalVM Enterprise Edition
- Affected
21.3.20- Fixed
- Oracle’s Oct 21 Security Alert patches
- Product
- OpenJDK, standalone runtimes
- Affected
27.0.1,25.0.5,21.0.13,17.0.21,11.0.33,8u512and earlier- Fixed
- Updated runtimes from each provider
- Product
- OpenJDK from Linux distributions
- Affected
- Most use the operating system’s certificates, OpenJDK says
- Fixed
- Updated operating system certificates
- Product
- Node.js
- Affected
- Earlier releases
- Fixed
22.23.4,24.22.1or26.12.1
Timeline
- Oct 17A researcher reports the keys to the root programs, and Firefox and Chrome block the intermediates.
- Oct 19The weak keys are disclosed to other trust stores, and Apple devices block the intermediates.
- Oct 20Microsoft platforms block the intermediates.
- Oct 21Oracle and OpenJDK release fixes, and Node.js updates its bundled root certificates.
Sources
- OpenJDK Vulnerability GroupPrimary source openjdk.org
- Oracle Security AlertPrimary source oracle.com
- Node.jsPrimary source nodejs.org
- eMudhra intermediate CA compromise sitePrimary source emudhra.we-have-a-problem.com