OpenJDK Issues High-Severity Security Advisory for Compromised Certificates
OpenJDK has released patches and workarounds for a critical CVSS 9.1 vulnerability affecting multiple Java versions due to compromised intermediate certificate authorities.
OpenJDK published a high-severity advisory for CVE-2026-91403 with a CVSS score of 9.1. Eight compromised intermediate certificate authorities ship natively with the Java Development Kit.
The issue impacts versions 8, 11, 17, 21, 25, and 27. It affects all applications running on the Java Virtual Machine and build tools relying on the JDK certificate store to fetch dependencies. You are affected if you run JDK 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33, 8u512, or earlier releases.
Run eed3si9n/emudhra-emsign-check or call CheckCompromisedCa.test locally or in continuous integration pipelines to verify your environment. Unpatched systems throw runtime exceptions when connecting to affected endpoints.
Oracle and Azul recommend manually blocking sixteen affected SHA-256 fingerprints before patched distributions deploy. For JDK 11 and newer, append the fingerprints to $JAVA_HOME/lib/security/blocked.certs and the corresponding jre path. JDK 8 uses blacklisted.certs. Updates trigger SSLHandshakeException errors confirming untrusted entities are blocked.
Update to the latest patched releases from Oracle, Temurin, and Zulu. Standalone installations managed through Coursier, SDKMAN!, or Homebrew need manual intervention across local environments, continuous integration servers, and Docker containers. Linux distributions using system-level certificates generally need only an operating system CA bundle update, but FreeBSD and Homebrew packages require direct updates.