OpenJDK, Oracle Distrust Compromised eMudhra Certificates (CVE-2026-91403)

An OpenJDK Vulnerability Advisory published on October 21, 2026 discloses CVE-2026-91403, rated CVSS 9.1. It covers eight compromised intermediate certificate authority certificates from India’s eMudhra whose private keys could be computed by an attacker.

The flaw affects JDK 8u504, 11.0.32.1, 17.0.21, 21.0.13, 25.0.5, 27.0.1 and earlier, because the bundled cacerts trust store chained to those intermediates. Oracle published its own security alert on October 21-22 with Java updates that distrust the impacted certificates, and Red Hat’s CVE entry confirms the CA store used in OpenJDK and Oracle Java included root certificates of authorities that signed intermediates with weak private keys issued by eMudhra.

Why a trust store matters

Java applications trust certificates from the bundled cacerts store to verify the identity of the servers they talk to. If an attacker can compute the private key for an intermediate CA that your runtime trusts, they can present a certificate your application will accept as legitimate. This is why the fix is about distrusting the certificates rather than patching a parsing bug.

The practical risk depends on whether an affected Java runtime actually loaded that trust chain in a network-facing path. Neither OpenJDK nor Oracle quantifies how many applications were exposed, so the honest answer is that a default install was vulnerable in principle and the fix is the mitigation.

What to do

OpenJDK recommends upgrading immediately. Where you cannot upgrade right away, the advisory lists workarounds: manually blocking the certificates through the blocked.certs file, or enabling certificate revocation checking.

Check the exact update release you are running rather than the major version. Because the affected list is specific, a machine on a later CPU may already be clear, while a machine on an older one that has not applied its quarterly update is not.

This is the same pattern as the record 1,413 flaws Microsoft patched in its October 2026 update: a large, vendor-published batch that rewards checking your actual version rather than your general habits.

What we did not do

We did not run a Java environment, reproduce the certificate forgery, or independently confirm how the eMudhra intermediate private keys became computable. Neither vendor attributes the compromise or states who exploited it. The CVSS score and affected-version list come from the advisory itself.