It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1241 advisory.

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with     network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion     or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the     specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also     applies to Java deployments, typically in clients running sandboxed Java Web Start applications or     sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and     rely on the Java sandbox for security. (CVE-2025-53057)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461,     8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM     Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network     access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM     Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical     data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition     accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g.,     through a web service which supplies data to the APIs. This vulnerability also applies to Java     deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets,     that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox     for security. (CVE-2025-53066)

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of     Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and     25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit     vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise     Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this     vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle     GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be     exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the     APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web     Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from     the internet) and rely on the Java sandbox for security. (CVE-2025-61748)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3964-1 advisory.

    - CVE-2025-53057: Fixed an issue where an unauthenticated attacker can achieve unauthorized creation,     deletion or modification access to critical data (bsc#1252414)
     - CVE-2025-53066: Fixed an issue where an unauthenticated attacker can achieve unauthorized access to     critical data or complete access (bsc#1252417)
     - CVE-2025-61748: Fixed an issue where an unauthenticated attacker can achieve unauthorized update,     insert or delete access to some resources (bsc#1252418)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:21485 advisory.

    * JDK: Enhance Path Factories (CVE-2025-53066)

    * JDK: Enhance Certificate Handling (CVE-2025-53057)

    * JDK: Enhance String Handling (CVE-2025-61748)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20947-1 advisory.

    Changes in java-21-openj9:

    - Make post scripts less noisy (bsc#1267355)

    - Use libalternatives instead of update-alternatives for       distributions where libalternatives is available

    - Update to OpenJDK 21.0.11 with OpenJ9 0.59.0 virtual machine
    - Including Oracle April 2026 CPU changes
      * CVE-2026-22007 (bsc#1262490), CVE-2026-22013 (bsc#1262494),         CVE-2026-22016 (bsc#1262495), CVE-2026-22018 (bsc#1262496),         CVE-2026-22021 (bsc#1262497), CVE-2026-23865 (bsc#1259118),         CVE-2026-34268 (bsc#1262500), CVE-2026-34282 (bsc#1262501)
    - OpenJ9 specific security fix
      * CVE-2026-1188 (bsc#1265261)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.59/

    - Update to OpenJDK 21.0.10 with OpenJ9 0.57.0 virtual machine
    - Including Oracle January 2026 CPU changes
      * CVE-2026-21925 (bsc#1257034), CVE-2026-21932 (bsc#1257036),         CVE-2026-21933 (bsc#1257037), CVE-2026-21945 (bsc#1257038)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.57/

    - Do not depend on update-desktop-files (jsc#PED-14507)

    - Update to OpenJDK 21.0.9 with OpenJ9 0.56.0 virtual machine
    - Including Oracle October 2025 CPU changes
      * CVE-2025-53057 (bsc#1252414), CVE-2025-53066 (bsc#1252417),         CVE-2025-61748 (bsc#1252418)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.56/

    - Update to OpenJDK 21.0.8 with OpenJ9 0.53.0 virtual machine
    - Including Oracle July 2025 CPU changes
      * CVE-2025-30749 (bsc#1246595), CVE-2025-30754 (bsc#1246598),         CVE-2025-50059 (bsc#1246575), CVE-2025-50106 (bsc#1246584)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.53/
    - Enable bootcycle build

    - Do not embed rebuild counter (bsc#1246806)

    - Add -std=gnu99 to CFLAGS to fix gcc15 compile time error. Since       the C++ part is on -std=gnu++98, this is the closest.

    - Update to OpenJDK 21.0.7 with OpenJ9 0.51.0 virtual machine
    - Including Oracle April 2025 CPU changes
      * CVE-2025-21587 (bsc#1241274), CVE-2025-30691 (bsc#1241275),         CVE-2025-30698 (bsc#1241276)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.51/

    - fix wrong execstack flag in libj9jit (bsc#1235844)

    - Update to OpenJDK 21.0.6 with OpenJ9 0.49.0 virtual machine
    - Including Oracle October 2024 and January 2025 CPU changes
      * CVE-2024-21208 (bsc#1231702), CVE-2024-21210 (bsc#1231711),         CVE-2024-21217 (bsc#1231716), CVE-2024-21235 (bsc#1231719),         CVE-2025-21502 (bsc#1236278)
      * OpenJ9 changes, see         https://www.eclipse.org/openj9/docs/version0.49/

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6037 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6037-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     October 24, 2025                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : openjdk-21     CVE ID         : CVE-2025-53057 CVE-2025-53066 CVE-2025-61748

    Several vulnerabilities have been discovered in the OpenJDK Java     runtime, which may result in incorrect string equality checks, XML     XXE/XEE attacks or incorrect certificate validation.

    For the stable distribution (trixie), these problems have been fixed in     version 21.0.9+10-1~deb13u1.

    We recommend that you upgrade your openjdk-21 packages.

    For the detailed security status of openjdk-21 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openjdk-21

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:18824 advisory.

    * JDK: Enhance Path Factories (CVE-2025-53066)
      * JDK: Enhance Certificate Handling (CVE-2025-53057)
      * JDK: Enhance String Handling (CVE-2025-61748)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the openjdk21 package has been released.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
271774	Amazon Linux 2023 : java-21-amazon-corretto, java-21-amazon-corretto-devel, java-21-amazon-corretto-headless (ALAS2023-2025-1241)	Nessus	Amazon Linux Local Security Checks	2025/10/28	2025/10/28	high
274421	SUSE SLES12: java-1_8_0-ibm / java-1_8_0-ibm-alsa / java-1_8_0-ibm-devel / etc (SUSE-SU-2025:3964-1)	Nessus	SuSE Local Security Checks	2025/11/7	2026/6/25	high
276736	RockyLinux 10 : java-25-openjdk (RLSA-2025:21485)	Nessus	Rocky Linux Local Security Checks	2025/11/25	2025/11/25	high
321009	openSUSE 16 Security Update : java-21-openj9 (openSUSE-SU-2026:20947-1)	Nessus	SuSE Local Security Checks	2026/6/14	2026/6/14	medium
271418	Debian dsa-6037 : openjdk-21-dbg - security update	Nessus	Debian Local Security Checks	2025/10/24	2025/10/24	high
272028	AlmaLinux 10 : java-21-openjdk (ALSA-2025:18824)	Nessus	Alma Linux Local Security Checks	2025/10/30	2025/10/30	high
332480	Photon OS 5.0: Openjdk21 PHSA-2025-5.0-91-0676	Nessus	PhotonOS Local Security Checks	2026/8/5	2026/8/5	high

检测

插件搜索

high

high

high

medium

high

high

high