Hi,
The following vulnerabilities were published for openjfx.
CVE-2026-91385[0]:
| Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM
| Enterprise Edition product of Oracle Java SE (component: JavaFX).
| Supported versions that are affected are Oracle Java SE: 8u503;
| Oracle JavaFX: 21.0.12, 25.0.4 and 27; Oracle GraalVM Enterprise
| Edition: 21.3.19.1.1. Easily exploitable vulnerability allows
| unauthenticated attacker with network access via multiple protocols
| to compromise Oracle Java SE, Oracle JavaFX, Oracle GraalVM
| Enterprise Edition. Successful attacks require human interaction
| from a person other than the attacker. Successful attacks of this
| vulnerability can result in unauthorized update, insert or delete
| access to some of Oracle Java SE, Oracle JavaFX, Oracle GraalVM
| Enterprise Edition accessible data as well as unauthorized read
| access to a subset of Oracle Java SE, Oracle JavaFX, Oracle GraalVM
| Enterprise Edition accessible data. Note: This vulnerability applies
| to Java deployments, typically in clients running sandboxed Java Web
| Start applications or sandboxed Java applets, that load and run
| untrusted code (e.g., code that comes from the internet) and rely on
| the Java sandbox for security. This vulnerability does not apply to
| Java deployments, typically in servers, that load and run only
| trusted code (e.g., code installed by an administrator). CVSS 3.1
| Base Score 5.4 (Confidentiality and Integrity impacts). CVSS
| Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).
CVE-2026-91402[1]:
| Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM
| Enterprise Edition product of Oracle Java SE (component: JavaFX).
| Supported versions that are affected are Oracle Java SE: 8u503;
| Oracle JavaFX: 21.0.12, 25.0.4 and 27; Oracle GraalVM Enterprise
| Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows
| unauthenticated attacker with network access via multiple protocols
| to compromise Oracle Java SE, Oracle JavaFX, Oracle GraalVM
| Enterprise Edition. Successful attacks require human interaction
| from a person other than the attacker. Successful attacks of this
| vulnerability can result in unauthorized read access to a subset of
| Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition
| accessible data. Note: This vulnerability applies to Java
| deployments, typically in clients running sandboxed Java Web Start
| applications or sandboxed Java applets, that load and run untrusted
| code (e.g., code that comes from the internet) and rely on the Java
| sandbox for security. This vulnerability does not apply to Java
| deployments, typically in servers, that load and run only trusted
| code (e.g., code installed by an administrator). CVSS 3.1 Base Score
| 3.1 (Confidentiality impacts). CVSS Vector:
| (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).
https://openjdk.org/groups/vulnerability/advisories/2026-10-20
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-91385
https://www.cve.org/CVERecord?id=CVE-2026-91385
[1] https://security-tracker.debian.org/tracker/CVE-2026-91402
https://www.cve.org/CVERecord?id=CVE-2026-91402
Please adjust the affected versions in the BTS as needed.