Alpine OpenJDK 11 CVE-2025-30754

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:43 vuln.today

DescriptionCVE.org

Alpine Linux: openjdk11 fixed in 11.0.28_p6-r0

AnalysisAI

OpenJDK 11 as packaged for Alpine Linux contains a vulnerability addressed in the 11.0.28_p6-r0 package release. The nature, impact, and attack surface of the underlying flaw are not disclosed in the available intelligence - the CVE record contains no description, CVSS score, or CWE classification. The EPSS score of 0.46% (64th percentile) indicates a moderate relative likelihood of exploitation compared to the broader CVE population, though the absolute probability remains low. No active exploitation has been identified at time of analysis.

Technical ContextAI

The affected component is Alpine Linux's openjdk11 package, which packages Oracle's OpenJDK 11 LTS release for musl-libc-based Alpine Linux environments. OpenJDK 11 is a long-term support Java runtime and development kit. Alpine's packaging (denoted by the '-r' suffix in versioning, e.g., 11.0.28_p6-r0) applies Alpine-specific patches on top of upstream OpenJDK releases. The upstream version 11.0.28 corresponds to a quarterly Oracle CPU (Critical Patch Update) cycle, which typically addresses multiple CVEs across the JVM, class libraries, and supporting tools. Without a CWE classification or detailed description, the root cause class (e.g., memory corruption, logic error, deserialization, cryptographic flaw) cannot be determined from available data.

Affected ProductsAI

The affected product is the openjdk11 package on Alpine Linux, in versions prior to 11.0.28_p6-r0. The fix version 11.0.28_p6-r0 is the first patched release per the Alpine Linux security advisory. No CPE strings were provided in the available intelligence, and no Oracle or upstream OpenJDK advisory URL was included. Affected systems are Alpine Linux instances running openjdk11 packages older than 11.0.28_p6-r0.

RemediationAI

Upgrade the Alpine Linux openjdk11 package to version 11.0.28_p6-r0 or later using the Alpine package manager: 'apk update && apk upgrade openjdk11'. This is the vendor-confirmed fix per the Alpine Linux security advisory. No workarounds or compensating controls are described in available data. Because the vulnerability details are undisclosed, specific feature disablement or traffic-blocking mitigations cannot be recommended. If immediate patching is not possible, consider restricting access to JVM-based services to trusted networks as a generic precautionary measure, acknowledging that this may degrade service availability and does not address the root cause.