CVE-2026-60589

A flaw was found in OpenJDK. The XML cryptographic component does not properly utilize the base Uniform Resource Identifier (URI) when resolving external references during data retrieval. A remote attacker could exploit this flaw by providing crafted XML input to induce the application to fetch resources from unintended locations. This issue can result in unauthorized information disclosure.

This vulnerability is rated as Moderate severity because successful exploitation requires specific conditions where Java applications parse untrusted cryptographic signatures with external URI resolution permitted, limiting the potential blast radius to partial confidentiality loss. In standard Red Hat Enterprise Linux environments, services running OpenJDK do not routinely dereference external resources within XML signature contexts unless explicitly configured to do so. An attacker who can supply maliciously structured XML data could cause the server to send unexpected outbound network requests, potentially accessing internal endpoints. System integrity and overall service availability remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.