Improper input validation in Oracle Java SE - CVE-2026-22008

Vulnerability identifier: #VU126763

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-22008

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Libraries component in Oracle Java SE. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Oracle Java SE
Debian Linux
Gentoo Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Basesystem Module
openEuler
Ubuntu
IBM Sterling Connect:Direct FTP+
IBM MQ Operator
IBM Power Hardware Management Console (HMC)
EMC Data Protection Advisor
IBM Decision Optimization for Cloud Pak for Data
IBM Sterling Connect:Direct for UNIX
SPSS Statistics
IBM Qradar SIEM
CICS Transaction Gateway for Multiplatforms
CICS Transaction Gateway Desktop Edition
IBM OpenPages with Watson
IBM supplied MQ Advanced container images
DB2 Query Management Facility
Robotic Process Automation for Cloud Pak
Data Product Hub
IBM Sterling Connect:Direct for Microsoft Windows
IBM MQ Appliance
openjdk-25-jdk (Ubuntu package)
openjdk-25-jdk-headless (Ubuntu package)
openjdk-25-jre-headless (Ubuntu package)
openjdk-25-jre (Ubuntu package)
openjdk-25-jre-zero (Ubuntu package)
openjdk-25-crac-jre-zero (Ubuntu package)
openjdk-25-crac-jre-headless (Ubuntu package)
openjdk-25-crac-jre (Ubuntu package)
openjdk-25-crac-jdk-headless (Ubuntu package)
openjdk-25-crac-jdk (Ubuntu package)
openjdk-26-jre-zero (Ubuntu package)
openjdk-26-jdk (Ubuntu package)
openjdk-26-jre (Ubuntu package)
openjdk-26-jre-headless (Ubuntu package)
openjdk-26-jdk-headless (Ubuntu package)
java-11-openjdk-headless-slowdebug
java-11-openjdk
java-11-openjdk-debuginfo
java-11-openjdk-debugsource
java-11-openjdk-demo
java-11-openjdk-demo-slowdebug
java-11-openjdk-devel
java-11-openjdk-devel-slowdebug
java-11-openjdk-headless
java-11-openjdk-javadoc
java-11-openjdk-javadoc-zip
java-11-openjdk-jmods
java-11-openjdk-jmods-slowdebug
java-11-openjdk-slowdebug
java-11-openjdk-src
java-11-openjdk-src-slowdebug
java-25-openjdk-headless-debuginfo
java-25-openjdk
java-25-openjdk-debuginfo
java-25-openjdk-devel-debuginfo
java-25-openjdk-demo
java-25-openjdk-devel
java-25-openjdk-headless
java-25-openjdk (Red Hat package)
media-libs/freetype
openjdk-25 (Debian package)

Install updates from vendor's website.

IBM Sterling Connect:Direct FTP+ - update to 1.3.0.5
IBM MQ Operator - addressed in versions 3.2.26 SC2, 4.0.1 SC2
IBM Qradar SIEM - update to 7.5.0 Update Pack 16
IBM supplied MQ Advanced container images - update to 10.0.0.0-r2
IBM Power Hardware Management Console (HMC) - addressed in versions 10.3.1064.1, 11.1.1112.1
EMC Data Protection Advisor - addressed in versions 19.12 SP1, 19.12 SP2
Robotic Process Automation for Cloud Pak - addressed in versions 23.0.20.7, 30.0.3
openjdk-25-jdk (Ubuntu package) - addressed in versions 25.0.3+9-2~22.04.2, 25.0.3+9-2~24.04.2, 25.0.3+9-2~25.10.2, 25.0.3+9-2~26.04.2
openjdk-25-jdk-headless (Ubuntu package) - addressed in versions 25.0.3+9-2~22.04.2, 25.0.3+9-2~24.04.2, 25.0.3+9-2~25.10.2, 25.0.3+9-2~26.04.2
openjdk-25-jre-headless (Ubuntu package) - addressed in versions 25.0.3+9-2~22.04.2, 25.0.3+9-2~24.04.2, 25.0.3+9-2~25.10.2, 25.0.3+9-2~26.04.2
openjdk-25-jre (Ubuntu package) - addressed in versions 25.0.3+9-2~22.04.2, 25.0.3+9-2~24.04.2, 25.0.3+9-2~25.10.2, 25.0.3+9-2~26.04.2
openjdk-25-jre-zero (Ubuntu package) - addressed in versions 25.0.3+9-2~22.04.2, 25.0.3+9-2~24.04.2, 25.0.3+9-2~25.10.2, 25.0.3+9-2~26.04.2
openjdk-25-crac-jre-zero (Ubuntu package) - addressed in versions 25.0.3+9-0ubuntu1~25.10.1, 25.0.3+9-0ubuntu1~26.04.1
openjdk-25-crac-jre-headless (Ubuntu package) - addressed in versions 25.0.3+9-0ubuntu1~25.10.1, 25.0.3+9-0ubuntu1~26.04.1
openjdk-25-crac-jre (Ubuntu package) - addressed in versions 25.0.3+9-0ubuntu1~25.10.1, 25.0.3+9-0ubuntu1~26.04.1
openjdk-25-crac-jdk-headless (Ubuntu package) - addressed in versions 25.0.3+9-0ubuntu1~25.10.1, 25.0.3+9-0ubuntu1~26.04.1
openjdk-25-crac-jdk (Ubuntu package) - addressed in versions 25.0.3+9-0ubuntu1~25.10.1, 25.0.3+9-0ubuntu1~26.04.1
openjdk-26-jre-zero (Ubuntu package) - addressed in versions 26.0.1+8-2~25.10.2, 26.0.1+8-2~26.04.2
openjdk-26-jdk (Ubuntu package) - addressed in versions 26.0.1+8-2~25.10.2, 26.0.1+8-2~26.04.2
openjdk-26-jre (Ubuntu package) - addressed in versions 26.0.1+8-2~25.10.2, 26.0.1+8-2~26.04.2
openjdk-26-jre-headless (Ubuntu package) - addressed in versions 26.0.1+8-2~25.10.2, 26.0.1+8-2~26.04.2
openjdk-26-jdk-headless (Ubuntu package) - addressed in versions 26.0.1+8-2~25.10.2, 26.0.1+8-2~26.04.2
java-11-openjdk-headless-slowdebug - update to 11.0.32.9-1
java-11-openjdk - update to 11.0.32.9-1
java-11-openjdk-debuginfo - update to 11.0.32.9-1
java-11-openjdk-debugsource - update to 11.0.32.9-1
java-11-openjdk-demo - update to 11.0.32.9-1
java-11-openjdk-demo-slowdebug - update to 11.0.32.9-1
java-11-openjdk-devel - update to 11.0.32.9-1
java-11-openjdk-devel-slowdebug - update to 11.0.32.9-1
java-11-openjdk-headless - update to 11.0.32.9-1
java-11-openjdk-javadoc - update to 11.0.32.9-1
java-11-openjdk-javadoc-zip - update to 11.0.32.9-1
java-11-openjdk-jmods - update to 11.0.32.9-1
java-11-openjdk-jmods-slowdebug - update to 11.0.32.9-1
java-11-openjdk-slowdebug - update to 11.0.32.9-1
java-11-openjdk-src - update to 11.0.32.9-1
java-11-openjdk-src-slowdebug - update to 11.0.32.9-1
java-25-openjdk-headless-debuginfo - update to 25.0.3.0-150700.15.10.1
java-25-openjdk - update to 25.0.3.0-150700.15.10.1
java-25-openjdk-debuginfo - update to 25.0.3.0-150700.15.10.1
java-25-openjdk-devel-debuginfo - update to 25.0.3.0-150700.15.10.1
java-25-openjdk-demo - update to 25.0.3.0-150700.15.10.1
java-25-openjdk-devel - update to 25.0.3.0-150700.15.10.1
java-25-openjdk-headless - update to 25.0.3.0-150700.15.10.1
java-25-openjdk (Red Hat package) - addressed in versions 25.0.3.0.9-1.el9, 25.0.3.0.9-1.el10_2
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6
Data Product Hub - addressed in versions 5.3.1 Patch 7, 5.4.0
IBM Sterling Connect:Direct for Microsoft Windows - addressed in versions 6.3.0.6.62, 6.4.0.4.35
IBM Sterling Connect:Direct for UNIX - addressed in versions 6.3.0.7.iFix015, 6.4.0.5.iFix020
IBM MQ Appliance - addressed in versions 9.4.0.25, 9.4.5.2
SPSS Statistics - addressed in versions 27.0.1.0 IF036, 28.0.1.1 IF018, 29.0.2.0 IF019, 30.0.0.0 IF015, 31.0.2.0 IF007
media-libs/freetype - update to 2.14.3
openjdk-25 (Debian package) - update to 25.0.3+9-2~deb13u1

• https://www.oracle.com/security-alerts/cpuapr2026.html

• Multiple vulnerabilities in Oracle Java SE
• SUSE update for java-25-openjdk
• Debian update for openjdk-25
• Multiple vulnerabilities in IBM OpenPages
• Ubuntu update for openjdk-25-crac
• Ubuntu update for openjdk-26
• Ubuntu update for openjdk-25
• Multiple vulnerabilities in IBM Db2 Query Management Facility
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM CICS Transaction Gateway for Multiplatforms and CICS Transaction Gateway Desktop Edition
• Multiple vulnerabilities in IBM Data Product Hub
• Multiple vulnerabilities in IBM SPSS Statistics
• Multiple vulnerabilities in IBM Sterling Connect:Direct for Microsoft Windows
• Multiple vulnerabilities in IBM MQ Appliance
• Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 update for java-25-openjdk
• Multiple vulnerabilities in IBM MQ Operator and Queue manager container images
• Multiple vulnerabilities in IBM Sterling Connect:Direct for UNIX
• Multiple vulnerabilities in IBM Sterling Connect:Direct FTP+
• Multiple vulnerabilities in IBM Power Hardware Management Console (HMC)
• Gentoo update for FreeType
• Multiple vulnerabilities in Data Protection Advisor
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM QRadar SIEM
• openEuler update for openjdk-11