Alpine OpenJDK 11 CVE-2025-30749

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:43 vuln.today

DescriptionCVE.org

Alpine Linux: openjdk11 fixed in 11.0.28_p6-r0

AnalysisAI

OpenJDK 11 on Alpine Linux received a security fix in package version 11.0.28_p6-r0, addressing one or more vulnerabilities tracked under CVE-2025-30749. The upstream fix corresponds to OpenJDK 11.0.28, which aligns with Oracle's Java SE quarterly Critical Patch Update (CPU) cycle. The specific vulnerability class, impact, and affected attack surface are not described in available data; EPSS scoring at the 84th percentile (2.12% absolute) indicates elevated exploitation probability relative to most CVEs, warranting prioritized patching on affected Alpine systems.

Technical ContextAI

The affected component is OpenJDK 11, the open-source implementation of Java SE 11, as packaged for Alpine Linux (musl libc-based). Alpine packages Java as openjdk11, and the fixed version 11.0.28_p6-r0 follows Alpine's versioning scheme: upstream version 11.0.28, Alpine patch level p6, package revision r0. OpenJDK 11 is a Long-Term Support (LTS) release. The root cause (CWE) is not disclosed in available intelligence. No CPE strings were provided, but the affected package is identifiable as cpe:2.3:a:oracle:openjdk:11.0.x:*:*:*:*:alpine_linux:*:* or the equivalent Alpine APK. The vulnerability class cannot be confirmed without vendor advisory or CWE data.

Affected ProductsAI

The affected product is OpenJDK 11 as packaged for Alpine Linux in versions prior to 11.0.28_p6-r0. This corresponds to upstream OpenJDK releases prior to 11.0.28. Alpine Linux systems running the openjdk11 APK package at any version below 11.0.28_p6-r0 should be considered potentially affected. The exact Alpine Linux branch versions (e.g., Alpine 3.18, 3.19, 3.20, edge) carrying the vulnerable package are not specified in available data. No CPE strings or vendor advisory URL were provided.

RemediationAI

The primary remediation is to upgrade the Alpine Linux openjdk11 package to version 11.0.28_p6-r0 or later using 'apk upgrade openjdk11' on affected Alpine systems. This fix is confirmed by the Alpine vendor source as the resolving version. If immediate upgrade is not possible, consider restricting network exposure of Java-based services, disabling untrusted code execution (e.g., disabling RMI, JNDI lookups, or Java deserialization endpoints where applicable), and running JVM workloads with SecurityManager restrictions where still supported. These compensating controls carry trade-offs: disabling JNDI may break legitimate application features; SecurityManager is deprecated in later Java versions. No alternative advisory URL was available in the provided intelligence - consult the Alpine Linux security tracker and Oracle Java SE CPU advisories for additional context.