CVE-2026-91403

The certificate authority (CA) store used in OpenJDK and Oracle Java included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL Java client applications and cause such applications to connect to malicious sites.

The OpenJDK RPM packages in Red Hat Enterprise Linux do not include their own CA certificate bundle and instead rely on ca-certificates packages for their default CA certificate store. Therefore, those OpenJDK versions require an updated ca-certificates RPM package to be installed to address this issue (refer to CVE-2026-114406 for more details about available ca-certificates package updates).

The OpenJDK packages in the Red Hat build of OpenJDK product for both Linux and Windows include their own CA certificate store file and therefore need to be updated separately from the ca-certificates updates.

The certificate bundle used in OpenJDK upstream included root certificates that signed eMudhra intermediate certificates with weak keys. OpenJDK upstream first attempted to address this issue by only blocking problematic intermediate certificates without changing the list of trusted root CAs. CVE-2026-91403 was assigned to that change. However, the fix proved insufficient and easy to bypass; therefore, OpenJDK upstream later removed the relevant root CA certificates, and a new CVE-2026-114820 was assigned to that change.

Since the problem for OpenJDK packages in Red Hat Enterprise Linux was addressed via ca-certificates updates, and the fix applied under this CVE is incorrect, Red Hat does not plan to issue updates for Red Hat Enterprise Linux claiming to address this CVE.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

See the security bulletin for a detailed mitigation procedure.