CVE-2026-10037

Red Hat statement

Red Hat products are not affected by this vulnerability. CVE-2026-10037 is a packaging defect specific to Debian/Ubuntu OpenJDK distributions: those distributions ship a desktop MIME handler that, via cautious-launcher and the mailcap application/x-java-archive association, can auto-execute a downloaded .jar file. The fix was delivered in the mailcap package (USN-8518-1), not in OpenJDK source code. Red Hat's OpenJDK RPMs ship only jconsole.desktop, which declares no MimeType and no .jar association, do not depend on or install mailcap, and register no application/x-java-archive handler. The vulnerable code path is therefore not present in any Red Hat OpenJDK build. This was independently confirmed downstream by the Hummingbird team, which resolved both trackers (HUM-3135, HUM-3136) as "Not a Bug / Vulnerable Code not Present."

Red Hat mitigation

No mitigation is required: Red Hat products are not affected. Red Hat's OpenJDK packages do not ship the .jar MIME handler, do not depend on the mailcap package, and register no application/x-java-archive association, so the vulnerable code path is not present. Users of Debian/Ubuntu OpenJDK should apply the upstream mailcap fix (USN-8518-1).