CVE-2026-114820

The certificate authority (CA) store used in OpenJDK and Oracle Java included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL Java client applications and cause such applications to connect to malicious sites.

The OpenJDK RPM packages in Red Hat Enterprise Linux do not include their own CA certificate bundle and instead rely on ca-certificates packages for their default CA certificate store. Therefore, those OpenJDK versions require an updated ca-certificates RPM package to be installed to address this issue (refer to CVE-2026-114406 for more details about available ca-certificates package updates).

The OpenJDK packages in the Red Hat build of OpenJDK product for both Linux and Windows include their own CA certificate store file and therefore need to be updated separately from the ca-certificates updates.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to distrust or remove affected eMudhra-related root CA certificates from the Java trust store and enforce certificate pinning: upgrade to the fixed Java 17 Openjdk Portable/Java 21 Openjdk/Java 21 Openjdk Portable/Java 25 Openjdk/Java 25 Openjdk Portable/Hi/Openjdk/Java Openjdk Portable.Portable.Jdk.El.X86 64.Tar.Xz/Java 11 Openjdk.Portable.Jdk.El.X86 64.Tar.Xz/Java 11 Openjdk.Win.Jdk.X86 64.Zip/Java Openjdk.Win.Jdk.X86 64.Zip/Java 21 Openjdk.Win.Jdk.X86 64.Zip/Java 17 Openjdk.Portable.Jdk.El.X86 64.Tar.Xz/Java 21 Openjdk.Portable.Jdk.X86 64.Tar.Xz/Java 17 Openjdk.Win.Jdk.X86 64.Zip/Java 25 Openjdk.Portable.Jdk.X86 64.Tar.Xz/Java 25 Openjdk.Win.Jdk.X86 64.Zip builds, which remove affected eMudhra-related root CA certificates from the Java trust store, closing all 2 injection vectors (man-in-the-middle TLS interception, forged certificate issuance using weak intermediate CA keys). Until patched, this is a concern on Java client applications, sandboxed Java Web Start applications, or applets running on Oracle Java SE, Oracle GraalVM, and OpenJDK builds on any platform, so Implement TLS certificate or public key pinning on client connections to prevent acceptance of certificates chained to weak eMudhra intermediate CAs. These controls limit blast radius and contain exploitation, but they do not fix the underlying weak intermediate CA key trust defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-404 Certificate Pinning (high)