[
https://issues.apache.org/jira/browse/FLINK-41266?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18134083#comment-18134083
]
Sergey Nuyanzin commented on FLINK-41266:
-----------------------------------------
[~chshining] why do we need it?
1. we don't deliver jdk
2. CVE tells only about Oracle Jdks
> Upgrade Java versions for CVE-2026-91403
> ----------------------------------------
>
> Key: FLINK-41266
> URL: https://issues.apache.org/jira/browse/FLINK-41266
> Project: Flink
> Issue Type: Improvement
> Reporter: Chanhae Oh
> Priority: Major
>
> The OpenJDK Vulnerability Group published a security advisory on October 21,
> 2026, covering *CVE-2026-91403* in the {{java.security}} component.
> According to the advisory, multiple JDK versions are affected, including JDK
> 17, 21, and 25. OpenJDK recommends upgrading affected JDK versions as soon as
> possible.
> We should review the Java versions currently used in Flink's build, test, CI,
> and release environments and update the affected versions where applicable.
> > [https://openjdk.org/groups/vulnerability/advisories/2026-10-21]
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
