- Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u502-b07. That fixes following CVEs: - CVE-2026-46968: JSSE, remote high-complexity integrity flaw in TLS certificate handling - CVE-2026-47010: ImageIO, remote high-complexity low-impact integrity flaw in JPEG handling - CVE-2026-47021: 2D, remote unauth partial DoS via XBM image support - CVE-2026-47027: Libraries, remote unauth partial DoS in Jar file processing - CVE-2026-47057: Scripting, remote unauth DoS via Nashorn index handling - CVE-2026-47058: Scripting, remote high-complexity high-confidentiality and high-integrity flaw in Dataview implementation - CVE-2026-47059: 2D, remote high-complexity low-impact partial DoS in AWT ImagingLib - CVE-2026-47063: Libraries, remote unauth high-integrity flaw in Jar handling - CVE-2026-60147: Security, remote unauth low-impact flaw in certification checking - CVE-2026-41254: Little CMS information disclosure / DoS, fixed by the in-tree LCMS bump to 2.19.1 (this build uses --with-lcms=bundled since RHEL 6 has no lcms2)