Oracle has released an emergency Java security update to address CVE-2026-91403, a critical vulnerability affecting how Java applications trust digital certificates.

The Java team at Oracle is working to address two common cases in which a virtual thread parks or blocks and the underlying native thread is not released. Java’s virtual threads, introduced in JDK 21 ...

Oracle issued emergency Java updates removing root certificates associated with the compromise of eMudhra certificate authority keys. The advisory covers specified versions across Java SE 8 through 27 ...