Alpine OpenJDK 11 CVE-2025-50106

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:43 vuln.today

DescriptionCVE.org

Alpine Linux: openjdk11 fixed in 11.0.28_p6-r0

AnalysisAI

OpenJDK 11 on Alpine Linux contains a vulnerability addressed in package version 11.0.28_p6-r0. The specific nature of the flaw is not disclosed in available intelligence - the CVE description provides only a patch reference without elaborating on root cause, attack vector, or impact class. With an EPSS score at the 77th percentile despite a low raw probability (1.01%), the vulnerability is statistically more likely to be exploited than the majority of CVEs, though active exploitation has not been confirmed. Security teams running Alpine Linux with openjdk11 packages prior to 11.0.28_p6-r0 should treat this as a priority update pending further vendor disclosure.

Technical ContextAI

The affected component is the openjdk11 package as distributed by Alpine Linux, fixed at version 11.0.28_p6-r0. OpenJDK 11 is a long-term support release of the Java Development Kit, widely used in containerized environments where Alpine Linux is a common base image due to its minimal footprint. The package version suffix '_p6' indicates an Alpine-specific patch level applied on top of upstream OpenJDK 11.0.28. No CWE is provided, so the root cause class (e.g., memory corruption, improper input validation, cryptographic weakness, deserialization flaw) cannot be determined from available data. No CPE strings were supplied, but the affected component can be inferred as cpe:2.3:a:oracle:openjdk:11:*:*:*:*:alpine_linux:*:*.

Affected ProductsAI

Alpine Linux systems running the openjdk11 package at versions prior to 11.0.28_p6-r0 are confirmed affected per vendor (Alpine) reporting. This encompasses any Alpine Linux release (including edge, 3.x stable streams) where the openjdk11 package has not been updated to 11.0.28_p6-r0 or later. The upstream OpenJDK 11.0.28 release, which this Alpine package is based on, is the reference fix point. No CPE strings or vendor advisory URL were provided in available intelligence; the Alpine Linux security tracker and aports repository should be consulted for full version matrix details.

RemediationAI

Update the openjdk11 package on all Alpine Linux systems to version 11.0.28_p6-r0 or later using the standard Alpine package manager: 'apk update && apk upgrade openjdk11'. This is the vendor-confirmed fix per Alpine's own security reporting. No workarounds or compensating controls are identified in available data, and none can be responsibly recommended without knowing the underlying vulnerability class. For containerized deployments using Alpine-based Java images, rebuild and redeploy containers using a base image that includes openjdk11 >= 11.0.28_p6-r0. Monitor the Alpine Linux security advisories page and the upstream Oracle Java SE CPU advisories for additional technical detail as disclosure matures.