Java Architecture Diary

Oct 22, 2026 · Information Security

AI-Accelerated Vulnerability Wave Hits Java: Oracle JDK Cert Trust & Tomcat Async Flaws Demand Urgent Patches

This week's vulnerability surge, accelerated by AI-powered auditing, struck Java's core with a critical Oracle JDK certificate trust flaw (CVE-2026-91403) and a Tomcat HTTP/2 async request smuggling bug (CVE-2026-101356), forcing immediate JDK upgrades and Tomcat version pins in Spring Boot projects.