OpenJDK 11 CVE-2025-50059

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:43 vuln.today

DescriptionCVE.org

Alpine Linux: openjdk11 fixed in 11.0.28_p6-r0

AnalysisAI

OpenJDK 11 on Alpine Linux contains a vulnerability addressed in the Alpine package release 11.0.28_p6-r0. The specific vulnerability class, attack vector, and exploitability conditions are not disclosed in the available intelligence data - only the vendor fix version is confirmed. EPSS places this at the 67th percentile despite a low 0.52% absolute exploitation probability, suggesting moderate relative risk among tracked CVEs. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.

Technical ContextAI

The affected component is OpenJDK 11, the open-source Java Development Kit runtime distributed via Alpine Linux's APK packaging system. Alpine packages OpenJDK using the musl libc toolchain and its own build infrastructure, meaning vulnerabilities may originate upstream in OpenJDK/Oracle's codebase or within Alpine's packaging and build layer itself. The fixed package version 11.0.28_p6-r0 follows Alpine's versioning convention: 11.0.28 is the upstream OpenJDK version, _p6 denotes the Alpine patch revision, and -r0 is the package release number. Without CWE or CVSS vector data, the root cause class - whether memory corruption, cryptographic weakness, sandbox escape, or other - cannot be confirmed from the available data.

Affected ProductsAI

Alpine Linux distributions running openjdk11 packages prior to version 11.0.28_p6-r0 are confirmed affected per the Alpine vendor advisory. The fix is confirmed in Alpine package openjdk11 version 11.0.28_p6-r0. Exact Alpine Linux branch versions (e.g., Alpine 3.18, 3.19, 3.20, edge) carrying the vulnerable package are not specified in the available data. Broader upstream OpenJDK 11 distributions outside of Alpine packaging (e.g., Adoptium, Amazon Corretto, Red Hat OpenJDK) are not confirmed affected by this CVE as reported, since the CVE is reported exclusively via the Alpine vendor source.

RemediationAI

Upgrade the openjdk11 Alpine package to version 11.0.28_p6-r0 or later using the standard Alpine package manager: 'apk update && apk upgrade openjdk11'. This is the vendor-confirmed fix. Users should consult the Alpine Linux security tracker and the official Alpine package repository for the specific advisory URL, as no direct advisory link was included in the available intelligence data. If immediate patching is not possible, consider restricting network exposure of Java application servers and disabling any unnecessary JVM features (e.g., JNDI, RMI, deserialization endpoints) as general compensating controls - though their applicability to this specific vulnerability cannot be confirmed without knowing the vulnerability class. No upstream OpenJDK patch version for non-Alpine distributions has been independently confirmed for this specific CVE.