Three OpenJDK 17 authentication flaws get Ubuntu fixes across five LTS lines
Victoria Shinder1 min readCanonical published USN-8795-1 on 21 September 2026, fixing three OpenJDK 17 vulnerabilities across Ubuntu 26.04, 24.04, 22.04, 20.04 and 18.04 LTS. All three are described as incorrect handling of user authentication by a remote attacker:
- CVE-2026-61308 — the Networking component; possible information leak (reported by Kai Aizen);
- CVE-2026-70907 — the JSSE component; possible denial of service;
- CVE-2026-60589 — the Security component; possible information leak.
The notice's operational line matters: after the package update you must restart any running Java applications for the changes to take effect.
What it means
A JVM patch is not applied until the process restarts, and long-lived services are exactly the ones that miss it. The package can be current while every running JVM still carries the old code. For a fleet of long-running Java services, "patched" means the roll of restarts is done, not that apt finished.
Three separate components, one description, is the tell. Networking, JSSE and Security all "did not correctly handle user authentication" — different code paths converging on the same class of mistake in the same release. That is the argument for treating the whole set as one upgrade rather than triaging by CVE.
The five-LTS spread is the real scope. A flaw fixed back to 18.04 is a flaw that has been shipping for years. The interesting question after any such notice is not "is it patched" but "how long was it exploitable" — and the LTS list is the honest answer.