[
https://issues.apache.org/jira/browse/FLINK-41266?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18134095#comment-18134095
]
Chanhae Oh commented on FLINK-41266:
------------------------------------
Hi [~Sergey Nuyanzin] !
IIUC, {{flink-docker}} uses a JDK/JRE as part of its Docker image. For example,
the Java 17 image is based on Eclipse Temurin:
*
[https://github.com/apache/flink-docker/blob/master/2.2/scala_2.12-java17-ubuntu/Dockerfile]
* [https://hub.docker.com/layers/library/eclipse-temurin/17-jre-noble]
Since this vulnerability is related to Java security/SSL functionality, I think
we should also check whether the JRE used by the Flink Docker image is affected.
For example, if Flink establishes an SSL/TLS connection to an external system
such as Kafka, the connection would rely on the Java runtime's SSL/TLS
implementation.
So I think it would be worth verifying whether the Temurin base images used by
{{flink-docker}} need to be updated as part of this fix. WDYT?
> Upgrade Java versions for CVE-2026-91403
> ----------------------------------------
>
> Key: FLINK-41266
> URL: https://issues.apache.org/jira/browse/FLINK-41266
> Project: Flink
> Issue Type: Improvement
> Reporter: Chanhae Oh
> Priority: Major
>
> The OpenJDK Vulnerability Group published a security advisory on October 21,
> 2026, covering *CVE-2026-91403* in the {{java.security}} component.
> According to the advisory, multiple JDK versions are affected, including JDK
> 17, 21, and 25. OpenJDK recommends upgrading affected JDK versions as soon as
> possible.
> We should review the Java versions currently used in Flink's build, test, CI,
> and release environments and update the affected versions where applicable.
> > [https://openjdk.org/groups/vulnerability/advisories/2026-10-21]
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
