Second Java fix for eMudhra’s compromised certificates removes their roots
- Affected
- Oracle Java SE and GraalVM builds before the Oct 24 patches, standalone OpenJDK runtimes without the fix, and Java on Debian, Devuan and Ubuntu. All versions and fixes
- CVE
- Vendors
- Oracle, eMudhra
Oracle and the OpenJDK project released a second Java fix on Oct 24 that removes the root certificates behind eMudhra’s compromised certificate authorities from Java’s trust store. Oracle tracks it as , rates it 9.1 under CVSS 3.1 and says it can be exploited over a network without authentication. OpenJDK says users of standalone runtimes should act at once, even if they updated in the past few days. Neither reports attacks on Java using the keys.
Oracle says its Oct 21 fix made Java distrust the eMudhra intermediate certificates whose private keys were compromised. The eMudhra incident site says they chain to roots that many trust stores carry, and that six are cross-signed by Sectigo and chain to AAA Certificate Services. OpenJDK’s manual workaround deletes that root and three of eMudhra’s emSign roots from a runtime’s keystore.
Oracle’s alert covers the Java SE, GraalVM for JDK and GraalVM Enterprise Edition builds in the versions table, with patches listed in its patch availability document. Oracle doesn’t test releases outside its Premier or Extended Support but says earlier versions are likely affected. Updated OpenJDK runtimes from other vendors should name issue JDK-8395690 and the CVE in their release notes, OpenJDK says.
OpenJDK now says Java packages on Debian and distributions built on it, such as Devuan and Ubuntu, need a manual workaround. A long-standing bug in Debian’s ca-certificates-java package means updating the system certificates isn’t enough, so the Java keystore must be deleted and rebuilt. On Arch Linux, Fedora, Gentoo, Oracle Linux and Red Hat Enterprise Linux, updating the system’s certificates is likely enough.
OpenJDK’s CheckCerts.java program shows whether a runtime still trusts the certificates. Until an update is out, OpenJDK gives two stopgaps, deleting the roots with keytool or turning on revocation checking. The eMudhra incident site warns that removing AAA Certificate Services may break websites that chain to it but aren’t affected.
- CVE
- Vendors
- Oracle, eMudhra
What to do
8 steps
- 3 Update standalone OpenJDK runtimes to a release whose notes name JDK-8395690 and CVE-2026-114820, even if they were updated after Oct 21.
Affected and fixed versions
| Product | Affected | Fixed |
|---|---|---|
| Oracle Java SE | 8u511-b32, 8u511-perf-b32, and the 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1 builds ending in .0.2 | Oracle’s Oct 24 Security Alert patches |
| Oracle GraalVM for JDK | The 17.0.21 and 21.0.13 builds ending in .0.2 | Oracle’s Oct 24 Security Alert patches |
| Oracle GraalVM Enterprise Edition | The 21.3.20 build ending in .0.2 | Oracle’s Oct 24 Security Alert patches |
| OpenJDK, standalone runtimes | Builds without JDK-8395690, including those updated for the Oct 21 fix | Each provider’s update, or OpenJDK’s keytool workaround until then |
| OpenJDK packages from Debian, Devuan and Ubuntu | Keep the roots after certificate updates, because of Debian bug 1069251 | Delete and rebuild /etc/ssl/certs/java/cacerts |
| OpenJDK packages from Arch Linux, Fedora, Gentoo, Oracle Linux and Red Hat Enterprise Linux | Use the operating system’s certificates | The distribution’s certificate update |
| OpenJDK packages from FreeBSD and Homebrew | Packages without the fix | The updated package, once out |
- Product
- Oracle Java SE
- Affected
8u511-b32,8u511-perf-b32, and the11.0.33,17.0.21,21.0.13,25.0.5and27.0.1builds ending in.0.2- Fixed
- Oracle’s Oct 24 Security Alert patches
- Product
- Oracle GraalVM for JDK
- Affected
- The
17.0.21and21.0.13builds ending in.0.2 - Fixed
- Oracle’s Oct 24 Security Alert patches
- Product
- Oracle GraalVM Enterprise Edition
- Affected
- The
21.3.20build ending in.0.2 - Fixed
- Oracle’s Oct 24 Security Alert patches
- Product
- OpenJDK, standalone runtimes
- Affected
- Builds without JDK-8395690, including those updated for the Oct 21 fix
- Fixed
- Each provider’s update, or OpenJDK’s keytool workaround until then
- Product
- OpenJDK packages from Debian, Devuan and Ubuntu
- Affected
- Keep the roots after certificate updates, because of Debian bug 1069251
- Fixed
- Delete and rebuild
/etc/ssl/certs/java/cacerts
- Product
- OpenJDK packages from Arch Linux, Fedora, Gentoo, Oracle Linux and Red Hat Enterprise Linux
- Affected
- Use the operating system’s certificates
- Fixed
- The distribution’s certificate update
- Product
- OpenJDK packages from FreeBSD and Homebrew
- Affected
- Packages without the fix
- Fixed
- The updated package, once out
Timeline
- Oct 21Oracle and OpenJDK release the first fix, which distrusts the compromised intermediates.
- Oct 24Oracle publishes a Security Alert for , and OpenJDK publishes its advisory and new guidance.
Sources
- Oracle advisoryPrimary source oracle.com
- OpenJDK noticePrimary source openjdk.org
- OpenJDK advisory Oct 24Primary source openjdk.org
- OpenJDK advisory Oct 21Primary source openjdk.org
- Oracle advisory Oct 21Primary source oracle.com
- eMudhra incident sitePrimary source emudhra.we-have-a-problem.com