Tagged articles

CVE-2026-91403

4 articles · Page 1 of 1

Oct 23, 2026 · Information Security

Java CVE-2026-91403: eMudhra CA Private Keys (4,56,115) Break Trust Chain

A critical Java vulnerability (CVE-2026-91403, CVSS 9.1) stems from three eMudhra intermediate CA private keys with absurdly small values (4, 56, 115) on the P-384 curve, allowing instant private key recovery and forged certificates; browsers blocked them via preloaded revocation lists, but Java's JSSE defaults to skipping revocation checks, requiring JDK upgrades or manual blocked.certs updates and enabling revocation checking.

CVE-2026-91403Java securityPKIX

0 likes · 15 min read

Java CVE-2026-91403: eMudhra CA Private Keys (4,56,115) Break Trust Chain

21CTO

Oct 22, 2026 · Information Security

Oracle Emergency Java Alert: CVE-2026-91403 Blocks eMudhra Weak Keys

Oracle issued an emergency Java patch for CVE-2026-91403 (CVSS 9.1) after eMudhra CA issued eight intermediate certificates with trivially weak elliptic-curve private keys, enabling anyone to forge HTTPS certificates; Java's independent trust store and disabled revocation checks require immediate JDK upgrades or manual blacklist updates.

CRLCVE-2026-91403Certificate Authority

0 likes · 10 min read

Oracle Emergency Java Alert: CVE-2026-91403 Blocks eMudhra Weak Keys

Su San Talks Tech

Oct 22, 2026 · Information Security

Critical Java JSSE Vulnerability CVE-2026-91403 (CVSS 9.1) Affects All Major JDK Versions

The article details CVE-2026-91403, a critical CVSS 9.1 vulnerability in Java's JSSE component affecting JDK 8, 11, 17, 21, 25, and 27, allowing remote unauthenticated attackers to compromise TLS communications, and provides upgrade and mitigation guidance.

CVE-2026-91403CVSS 9.1JDK upgrade

0 likes · 13 min read

Critical Java JSSE Vulnerability CVE-2026-91403 (CVSS 9.1) Affects All Major JDK Versions

Java Architecture Diary

Oct 22, 2026 · Information Security

AI-Accelerated Vulnerability Wave Hits Java: Oracle JDK Cert Trust & Tomcat Async Flaws Demand Urgent Patches

This week's vulnerability surge, accelerated by AI-powered auditing, struck Java's core with a critical Oracle JDK certificate trust flaw (CVE-2026-91403) and a Tomcat HTTP/2 async request smuggling bug (CVE-2026-101356), forcing immediate JDK upgrades and Tomcat version pins in Spring Boot projects.

AI vulnerability discoveryCVE-2026-101356CVE-2026-91403

0 likes · 8 min read

AI-Accelerated Vulnerability Wave Hits Java: Oracle JDK Cert Trust & Tomcat Async Flaws Demand Urgent Patches