--- title: 'USN-8334-1: CRaC JDK 25 vulnerabilities | Ubuntu security notices' description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/notices/USN-8334-1 --- 1. [Ubuntu Security Notices](https://ubuntu.com/security/notices) 2. USN-8334-1 --- # USN-8334-1: CRaC JDK 25 vulnerabilities Publication date 28 May 2026 Overview Several security issues were fixed in CRaC JDK 25. Releases [26.04 LTS](https://ubuntu.com/security/notices?release=resolute) [25.10](https://ubuntu.com/security/notices?release=questing) --- Open side navigation ## Packages * [openjdk-25-crac](https://ubuntu.com/security/cves?package=openjdk-25-crac) - Open Source Java implementation with Coordinated Restore at Checkpoints ## Details Thomas Beckers discovered that the JAXP component of CRaC JDK 25 did not correctly authenticate certain APIs. A remote unauthenticated attacker could possibly use this issue to gain unauthorized access to sensitive information. ([CVE-2026-22016](https://ubuntu.com/security/CVE-2026-22016)) It was discovered that the Networking component of CRaC JDK 25 did not correctly authenticate certain APIs. A remote unauthenticated attacker could possibly use this issue to cause a denial of service. ([CVE-2026-34282](https://ubuntu.com/security/CVE-2026-34282)) It was discovered that the JSSE component of CRaC JDK 25 did not correctly authenticate certain APIs. A remote unauthenticated attacker could possibly use this issue to cause a denial of service. ([CVE-2026-22021](https://ubuntu.com/security/CVE-2026-22021)) It was discovered that the JGSS component of CRaC JDK 25 did not correctly authenticate certain APIs. A remote attacker could possibly use... --- Show more ## Update instructions This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart any running Java applications to make all the necessary changes. [Learn more about how to get the fixes.](https://ubuntu.com/security/cves/about#security) The problem can be corrected by updating your system to the following package versions: | Ubuntu Release | Package Version | | --- | --- | | 26.04 LTS resolute | [openjdk-25-crac-jdk](https://launchpad.net/ubuntu/+source/openjdk-25-crac) –  [25.0.3+9-0ubuntu1~26.04.1](https://launchpad.net/ubuntu/+source/openjdk-25-crac/25.0.3+9-0ubuntu1~26.04.1) | | | | [openjdk-25-crac-jdk-headless](https://launchpad.net/ubuntu/+source/openjdk-25-crac) –  [25.0.3+9-0ubuntu1~26.04.1](https://launchpad.net/ubuntu/+source/openjdk-25-crac/25.0.3+9-0ubuntu1~26.04.1) | | | | [openjdk-25-crac-jre](https://launchpad.net/ubuntu/+source/openjdk-25-crac) –  [25.0.3+9-0ubuntu1~26.04.1](https://launchpad.net/ubuntu/+source/openjdk-25-crac/25.0.3+9-0ubuntu1~26.04.1) | | | | [openjdk-25-crac-jre-headless](https://launchpad.net/ubuntu/+source/openjdk-25-crac) –  [25.0.3+9-0ubuntu1~26.04.1](https://launchpad.net/ubuntu/+source/openjdk-25-crac/25.0.3+9-0ubuntu1~26.04.1) | | | | [openjdk-25-crac-jre-zero](https://launchpad.net/ubuntu/+source/openjdk-25-crac) –  [25.0.3+9-0ubuntu1~26.04.1](https://launchpad.net/ubuntu/+source/openjdk-25-crac/25.0.3+9-0ubuntu1~26.04.1) | | | | 25.10 questing | [openjdk-25-crac-jdk](https://launchpad.net/ubuntu/+source/openjdk-25-crac) –  [25.0.3+9-0ubuntu1~25.10.1](https://launchpad.net/ubuntu/+source/openjdk-25-crac/25.0.3+9-0ubuntu1~25.10.1) | | | | [openjdk-25-crac-jdk-headless](https://launchpad.net/ubuntu/+source/openjdk-25-crac) –  [25.0.3+9-0ubuntu1~25.10.1](https://launchpad.net/ubuntu/+source/openjdk-25-crac/25.0.3+9-0ubuntu1~25.10.1) | | | | [openjdk-25-crac-jre](https://launchpad.net/ubuntu/+source/openjdk-25-crac) –  [25.0.3+9-0ubuntu1~25.10.1](https://launchpad.net/ubuntu/+source/openjdk-25-crac/25.0.3+9-0ubuntu1~25.10.1) | | | | [openjdk-25-crac-jre-headless](https://launchpad.net/ubuntu/+source/openjdk-25-crac) –  [25.0.3+9-0ubuntu1~25.10.1](https://launchpad.net/ubuntu/+source/openjdk-25-crac/25.0.3+9-0ubuntu1~25.10.1) | | | | [openjdk-25-crac-jre-zero](https://launchpad.net/ubuntu/+source/openjdk-25-crac) –  [25.0.3+9-0ubuntu1~25.10.1](https://launchpad.net/ubuntu/+source/openjdk-25-crac/25.0.3+9-0ubuntu1~25.10.1) | | | --- ### Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines. [Get Ubuntu Pro](https://ubuntu.com/pro) ## References * [CVE-2026-34282](https://ubuntu.com/security/CVE-2026-34282) * [CVE-2026-34268](https://ubuntu.com/security/CVE-2026-34268) * [CVE-2026-23865](https://ubuntu.com/security/CVE-2026-23865) * [CVE-2026-22021](https://ubuntu.com/security/CVE-2026-22021) * [CVE-2026-22018](https://ubuntu.com/security/CVE-2026-22018) * [CVE-2026-22016](https://ubuntu.com/security/CVE-2026-22016) * [CVE-2026-22013](https://ubuntu.com/security/CVE-2026-22013) * [CVE-2026-22008](https://ubuntu.com/security/CVE-2026-22008) * [CVE-2026-22007](https://ubuntu.com/security/CVE-2026-22007) ## Related notices * [USN-8341-1](https://ubuntu.com/security/notices/USN-8341-1) * [USN-8339-1](https://ubuntu.com/security/notices/USN-8339-1) * [USN-8333-1](https://ubuntu.com/security/notices/USN-8333-1) * [USN-8332-1](https://ubuntu.com/security/notices/USN-8332-1) * [USN-8331-1](https://ubuntu.com/security/notices/USN-8331-1) * [USN-8330-1](https://ubuntu.com/security/notices/USN-8330-1) * [USN-8328-1](https://ubuntu.com/security/notices/USN-8328-1) * [USN-8327-1](https://ubuntu.com/security/notices/USN-8327-1) * [USN-8086-1](https://ubuntu.com/security/notices/USN-8086-1)