Distribution advisory
This page covers CVE-2026-21932 as tracked by BellSoft, for the package openjdk-nik-23-17. The fix is available in version 23.0.11-r0; earlier versions remain affected.
How this vulnerability can be exploited
This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. A user must be tricked into taking some action. The scope is changed, meaning a successful attack can affect components beyond the vulnerable one. Rated impact: confidentiality none, integrity high, availability none.
CVSS metrics in full
The score comes from this vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
- Attack vector: Network — reachable from anywhere that can route to the service.
- Attack complexity: Low — the attack works reliably, with no preparation.
- Privileges required: None — an unauthenticated stranger can try it.
- User interaction: Required — someone has to click, open or visit something.
- Scope: Changed — a successful attack reaches components beyond the vulnerable one.
- Confidentiality impact: None.
- Integrity impact: High — total loss, or loss the attacker controls.
- Availability impact: None.
Weakness class
BELL-CVE-2026-21932 is classified as CWE-1287: Improper Validation of Specified Type of Input. The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
Affected software
BELL-CVE-2026-21932 is recorded against 20 packages.
- openjdk-nik-23-17 (from 23.0.4-r1 up to 23.0.11-r0)
- openjdk-nik-23-21 (from 23.1.3-r1 up to 23.1.10-r0)
- openjdk-nik-25-25 (from 25.0.0-r0 up to 25.0.2-r0)
- openjdk11 (from 11.0.19_p7-r0 up to 11.0.30_p9-r0)
- openjdk11-container-jre (from 11.0.19_p7-r0 up to 11.0.30_p9-r0)
- openjdk11-lite (from 11.0.19_p7-r1 up to 11.0.30_p9-r0)
- openjdk11-perf (from 11.0.29_p11-r0 up to 11.0.30_p10-r0)
- openjdk17 (from 17.0.7_p7-r1 up to 17.0.18_p10-r0)
- openjdk17-container-jre (from 17.0.7_p7-r0 up to 17.0.18_p10-r0)
- openjdk17-crac (from 17.0.10_p13-r0 up to 17.0.18_p11-r0)
- openjdk17-lite (from 17.0.7_p7-r1 up to 17.0.18_p10-r0)
- openjdk21 (from 21_p37-r0 up to 21.0.10_p10-r0)
- openjdk21-container-jre (from 21_p37-r0 up to 21.0.10_p10-r0)
- openjdk21-crac (from 21.0.2_p15-r0 up to 21.0.10_p11-r0)
- openjdk21-lite (from 21_p37-r0 up to 21.0.10_p10-r0)
- openjdk25 (from 25_p37-r0 up to 25.0.2_p12-r0)
- openjdk25-container-jre (from 25_p37-r0 up to 25.0.2_p12-r0)
- openjdk25-lite (from 25_p37-r0 up to 25.0.2_p12-r0)
- openjdk8 (from 8u372_p7-r1 up to 8.482_p10-r0)
- openjdk8-perf (from 8.472_p10-r0 up to 8.482_p11-r0)
Timeline and source
Published on 22 January 2026 and last revised on 19 March 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.
References
docs.bell-sw.com (Advisory)
Other advisories for this package
openjdk-nik-23-17 has other advisories on record. If you are patching this one, these are worth checking on the same host:
Same weakness in other software
These advisories are the same class of weakness (CWE-1287: Improper Validation of Specified Type of Input) in other software:
