---
id: CVE-2026-91396
title: 'openjdk: Improve Pack200 handling (Oracle CPU 2026-10) (CVE-2026-91396)'
summary: >-
  A flaw was found in the Utility component of OpenJDK. An unauthenticated
  remote attacker can exploit this vulnerability by supplying untrusted data to
  component APIs over the network. A successful attack can allow unauthorized
  modification…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'
cvssSource: vendor
cwe: CWE-22
vendor: Red Hat
product: Red Hat Enterprise Linux 7
affected:
  - build_of_openjdk 1.8
  - build_of_openjdk_11_els
  - enterprise_linux 6
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
published: '2026-10-20'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T22:00:47+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91396.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91396.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-91396'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2557097'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-91396'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91396'
  - url: 'https://www.oracle.com/security-alerts/cpuoct2026.html'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00333
epssPercentile: 0.26336
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-22T18:46:44.714708Z'
ingestedAt: '2026-10-20T22:23:33.777Z'
---

## Overview

A flaw was found in the Utility component of OpenJDK. An unauthenticated remote attacker can exploit this vulnerability by supplying untrusted data to component APIs over the network. A successful attack can allow unauthorized modification or deletion of accessible data and cause a partial Denial of Service (DoS).

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat build of OpenJDK 1.8, Red Hat build of OpenJDK 11 ELS, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat build of OpenJDK 1.8, Red Hat build of OpenJDK 11 ELS, … · updated 2026-10-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91396.json)

**openjdk: Improve Pack200 handling (Oracle CPU 2026-10)** — rated Moderate by Red Hat. Released 2026-10-20, updated 2026-10-22.

Affected:

- Red Hat build of OpenJDK 1.8
- Red Hat build of OpenJDK 11 ELS
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

No fix planned:

- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat build of OpenJDK 1.8
- Red Hat build of OpenJDK 11 ELS
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

Not affected:

- Red Hat build of OpenJDK 17
- Red Hat build of OpenJDK 21
- Red Hat build of OpenJDK 25
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images

## Remediation

Out of support scope