Security advisory: update your JDK (CVE-2026-91403)

Thursday 22 October 2026

Piotr Chabelski (VirtusLab), Eugene Yokota

BLOG

On 2026-10-21, OpenJDK published a vulnerability advisory for CVE-2026-91403 (CVSS 9.1), which concerns eight compromised intermediate CA certificates shipped with the JDK. It affects all supported JDK lines: 8, 11, 17, 21, 25 and 27.

This is not a Scala issue, but it affects every application running on the JVM, including Scala ones, as well as Scala build tools that use the JDK’s certificates to download dependencies.

Am I affected?

You are affected if you use JDK 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33, 8u512, or earlier.

To check if your JDK is vulnerable, checkout eed3si9n/emudhra-emsign-check on your local machine, or call CheckCompromisedCa.test from your CI.

$ sbt run
[info] welcome to sbt 1.13.0 (Azul Systems, Inc. Java 1.8.0_402)
[info] running main
Java 1.8.0_402 (/Users/xxx/.sdkman/candidates/java/zulu8.76.0.17-ca-jdk8.0.402-macosx_aarch64/zulu-8.jdk/Contents/Home/jre)
VULNERABLE (HTTP 200) https://dv-g3b-emudhra.we-have-a-problem.com/
VULNERABLE (HTTP 200) https://dv-g3c-emudhra.we-have-a-problem.com/
VULNERABLE (HTTP 200) https://ov-g3b-emudhra.we-have-a-problem.com/
VULNERABLE (HTTP 200) https://ov-g3c-emudhra.we-have-a-problem.com/
VULNERABLE (HTTP 200) https://ev-g3b-emudhra.we-have-a-problem.com/
VULNERABLE (HTTP 200) https://ev-g3c-emudhra.we-have-a-problem.com/
VULNERABLE (HTTP 200) https://dv-g3b-aaa-emudhra.we-have-a-problem.com/
VULNERABLE (HTTP 200) https://dv-g3c-aaa-emudhra.we-have-a-problem.com/
VULNERABLE (HTTP 200) https://ov-g3b-aaa-emudhra.we-have-a-problem.com/
VULNERABLE (HTTP 200) https://ov-g3c-aaa-emudhra.we-have-a-problem.com/
VULNERABLE (HTTP 200) https://ev-g3b-aaa-emudhra.we-have-a-problem.com/
VULNERABLE (HTTP 200) https://ev-g3c-aaa-emudhra.we-have-a-problem.com/
[error] java.lang.RuntimeException: compromised CAs are in use, or we encountered a network error
[error]   at scala.sys.package$.error(package.scala:27)
[error]   at CheckCompromisedCa$.test(CheckCompromisedCa.scala:36)
[error]   at CheckCompromisedCa$.main(CheckCompromisedCa.scala:32)
[error]   at main.main(CheckCompromisedCa.scala:22)
[error]   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
[error]   at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
[error]   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
[error]   at java.lang.reflect.Method.invoke(Method.java:498)
[error] stack trace is suppressed; run last Compile / run for the full output
[error] (Compile / run) compromised CAs are in use, or we encountered a network error

Distrust the compromised certificates manually

Update 2026-10-24: Until you can update to the fixed JDK distributions, we recommend manually distrusting the compromised certificates.

Copy distrust-emudhra.sh to your local environment or on CI, and run it first using ./distrust-emudhra.sh --dry-run $JAVA_HOME:

$ java -version
openjdk version "17.0.12" 2024-07-16 LTS
OpenJDK Runtime Environment Zulu17.52+17-CA (build 17.0.12+7-LTS)
OpenJDK 64-Bit Server VM Zulu17.52+17-CA (build 17.0.12+7-LTS, mixed mode, sharing)
$ chmod +x distrust-emudhra.sh
$ ./distrust-emudhra.sh --dry-run $JAVA_HOME
(dry run — no changes will be made)
JAVA_HOME:   /Users/xxx/.jenv/versions/17.0
trust store: /Users/xxx/.jenv/versions/17.0/lib/security/cacerts
would remove:
  cert_91_emsign_root_ca___c191
  cert_92_emsign_ecc_root_ca___c392
  comodoaaaca [jdk]
  emsigneccrootcag3 [jdk]
  emsignrootcag1 [jdk]
  emsignrootcag2 [jdk]
remaining emSign/AAA entries (none expected, unless AAA deliberately kept):
cert_91_emsign_root_ca___c191, Jul 9, 2024, trustedCertEntry,
cert_92_emsign_ecc_root_ca___c392, Jul 9, 2024, trustedCertEntry,
comodoaaaca [jdk], Dec 31, 2003, trustedCertEntry,
emsigneccrootcag3 [jdk], Feb 18, 2018, trustedCertEntry,
emsignrootcag1 [jdk], Feb 18, 2018, trustedCertEntry,
emsignrootcag2 [jdk], Feb 18, 2018, trustedCertEntry,

Next run without --dry-run:

$ ./distrust-emudhra.sh $JAVA_HOME
JAVA_HOME:   /Users/xxx/.jenv/versions/17.0
trust store: /Users/xxx/.jenv/versions/17.0/lib/security/cacerts
Warning: use -cacerts option to access cacerts keystore
removed: cert_91_emsign_root_ca___c191
Warning: use -cacerts option to access cacerts keystore
removed: cert_92_emsign_ecc_root_ca___c392
Warning: use -cacerts option to access cacerts keystore
removed: comodoaaaca [jdk]
Warning: use -cacerts option to access cacerts keystore
removed: emsigneccrootcag3 [jdk]
Warning: use -cacerts option to access cacerts keystore
removed: emsignrootcag1 [jdk]
Warning: use -cacerts option to access cacerts keystore
removed: emsignrootcag2 [jdk]
remaining emSign/AAA entries (none expected, unless AAA deliberately kept):
  (none)

On GitHub Actions it might look like:

    - name: Distrust compromised certs manually
      shell: bash
      run: |
        if [ "$RUNNER_OS" = "Windows" ]; then
          bash bin/distrust-emudhra.sh "$JAVA_HOME"
        else
          sudo -E bash bin/distrust-emudhra.sh "$JAVA_HOME"
        fi

Run eed3si9n/emudhra-emsign-check to verify that the certificates are blocked. If it’s successful, you should see an output like this:

$ sbt run
[info] running main
Java 17.0.12 (/Users/xxx/.sdkman/candidates/java/17.0.12-zulu/zulu-17.jdk/Contents/Home)
OK https://dv-g3b-emudhra.we-have-a-problem.com/
  SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
OK https://dv-g3c-emudhra.we-have-a-problem.com/
  SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
....

Note: Previously we’ve advised to block the certificates using $JAVA_HOME/lib/security/blocked.certs per Oracle and other’s recommendation; however, since then Sonatype Research Team has blogged that such blocking can be bypassed by reencoding with a variation of the key.

Updating to the fixed JDKs

We advise to update to the fixed JDKs when they become available.

JDK	Oracle	Temurin	Zulu
JDK 8	8u511	n/a	8u512-b08
JDK 11	11.0.33.0.2	n/a	11.0.33+9
JDK 17	17.0.21.0.2	17.0.21+9 ¹	17.0.21+9
JDK 21	21.0.13.0.2	21.0.13+9 ¹	21.0.13+9
JDK 25	25.0.5.0.2	25.0.5+8 ¹	25.0.5+8
Release notes			Note

Standalone JDKs (for example ones installed via Coursier, SDKMAN!, Homebrew, or downloaded directly from a vendor): update to the latest patch release of your JDK as soon as possible. Remember to update every JDK you have installed, including the ones used in CI and in Docker images.
JDKs provided by your Linux distribution (Arch Linux, Debian, Fedora, Red Hat Enterprise Linux, Ubuntu and others): these typically use the operating system’s certificates, so updating the system’s CA certificates is sufficient. Note that FreeBSD and Homebrew packages must be updated directly.

As of 2026-10-24, on GitHub Actions setup-java, the only distribution with the fixed JDK with the full JDK 8, 11, 17, 25 availability is zulu, or Azul Zulu. Eclipse Temurin is still running TCKs and building their distributions so temurin is only partially available. It works for JDK 17 on ubuntu-latest and macos-latest, but not windows-latest etc. ↩ ↩² ↩³