[
https://issues.apache.org/jira/browse/FLINK-41266?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18134136#comment-18134136
]
Chanhae Oh commented on FLINK-41266:
------------------------------------
Good point.
I was referring to the OpenJDK advisory for the same CVE, which also lists
OpenJDK 17 and 21 as affected. That's why I thought we might need to check the
Temurin image as well.
But I may be missing something here. Do you think the Temurin image is out of
scope for this issue?
> Upgrade Java versions for CVE-2026-91403
> ----------------------------------------
>
> Key: FLINK-41266
> URL: https://issues.apache.org/jira/browse/FLINK-41266
> Project: Flink
> Issue Type: Improvement
> Reporter: Chanhae Oh
> Priority: Major
>
> The OpenJDK Vulnerability Group published a security advisory on October 21,
> 2026, covering *CVE-2026-91403* in the {{java.security}} component.
> According to the advisory, multiple JDK versions are affected, including JDK
> 17, 21, and 25. OpenJDK recommends upgrading affected JDK versions as soon as
> possible.
> We should review the Java versions currently used in Flink's build, test, CI,
> and release environments and update the affected versions where applicable.
> > [https://openjdk.org/groups/vulnerability/advisories/2026-10-21]
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
