products / openjdk

OpenJDK

OpenJDK is the open-source Java SE reference implementation used by most production JVMs. Oracle publishes quarterly Critical Patch Updates that list both oracle:openjdk and oracle:jdk. High-severity history spans crypto verification, Hotspot, Security libraries, and JSSE TLS.

api usage

Querying OpenJDK

product slugopenjdk

version format17.0.0, 21.0.5, 11.0.21

bash

curl "https://api.attestd.io/v1/check?product=openjdk&version=17.0.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

OpenJDK 17.0.0 sits below the January 2024 CPU floors for the 17 line. The response shows a high risk_state driven by CVE-2024-20952 and CVE-2024-20918, with a fixed_version of 17.0.12.

json

{
  "product": "openjdk",
  "version": "17.0.0",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": [
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": "17.0.10",
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2021-32553",
    "CVE-2021-35556",
    "CVE-2021-35559",
    "CVE-2021-35561",
    "CVE-2021-35564",
    "CVE-2021-35578",
    "CVE-2021-35586",
    "CVE-2021-35603",
    "CVE-2022-21248",
    "CVE-2022-21277",
    "CVE-2022-21282",
    "CVE-2022-21283",
    "CVE-2022-21291",
    "CVE-2022-21293",
    "CVE-2022-21294",
    "CVE-2022-21296",
    "CVE-2022-21299",
    "CVE-2022-21305",
    "CVE-2022-21340",
    "CVE-2022-21341",
    "CVE-2022-21360",
    "CVE-2022-21365",
    "CVE-2022-21366",
    "CVE-2022-21476",
    "CVE-2022-21540",
    "CVE-2022-21541",
    "CVE-2022-34169",
    "CVE-2023-21930",
    "CVE-2023-21937",
    "CVE-2023-21938",
    "CVE-2023-21939",
    "CVE-2023-21954",
    "CVE-2023-21967",
    "CVE-2023-21968",
    "CVE-2024-20952"
  ],
  "cves": null,
  "max_epss": 0.81039,
  "last_updated": "2026-07-27T04:24:01.584272Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}

safe version

OpenJDK 21.0.5 is a current 21 LTS update that includes the CPU fixes for the CVEs listed below.

bash

curl "https://api.attestd.io/v1/check?product=openjdk&version=21.0.5" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

OpenJDK advisories arrive on Oracle's quarterly CPU schedule. Crypto and TLS flaws (Psychic Signatures, JSSE) sit alongside Hotspot and Security-component issues that affect multiple LTS lines in the same advisory.

CVE	Description	Affects	CVSS
`CVE-2022-21449`	Flawed ECDSA signature verification in Java Libraries accepts invalid signatures as valid (Psychic Signatures).	Java SE 17.0.2 and 18	7.5
`CVE-2024-20952`	Difficult-to-exploit Security-component flaw lets unauthenticated network attackers read or modify critical data.	8u391, 11.0.21, 17.0.9, 21.0.1	7.4
`CVE-2024-20918`	Hotspot flaw lets unauthenticated network attackers compromise confidentiality and integrity of Java data.	8u391, 11.0.21, 17.0.9, 21.0.1	7.4
`CVE-2023-21930`	JSSE TLS flaw lets unauthenticated attackers compromise confidentiality and integrity over the network.	8u361, 11.0.18, 17.0.6, 20	7.4

data sources

OpenJDK and JDK CPE overlap

NVD lists OpenJDK under the Oracle vendor namespace. Many Critical Patch Update advisories also attach the commercial JDK CPE:

cpe:2.3:a:oracle:openjdkOpenJDK builds (Attestd primary)

cpe:2.3:a:oracle:jdkOracle JDK; often co-listed on the same CVE

Attestd maps the openjdk slug to oracle:openjdk and applies version ranges that match OpenJDK builds, so Oracle JDK-only version floors do not inflate OpenJDK results.

All products Apache Tomcat Log4j Quickstart