openjfx - Debian Package Tracker

general

source: openjfx (main)
version: 21.0.12+3-3
maintainer: Debian Java Maintainers (archive) (DMD)
uploaders: Emmanuel Bourg [DMD]
arch: all any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 11.0.11+0-1
oldstable: 11.0.11+1-3
stable: 11.0.11+1-7
testing: 21.0.12+3-3
unstable: 21.0.12+3-3

versioned links

11.0.11+0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
11.0.11+1-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
11.0.11+1-7: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
21.0.12+3-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libopenjfx-java (1 bugs: 0, 1, 0, 0)
libopenjfx-java-doc
libopenjfx-jni
openjfx (2 bugs: 0, 2, 0, 0)
openjfx-source

action needed

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2026-91385: Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and 27; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).
CVE-2026-91402: Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and 27; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).

Created: 2026-10-22 Last update: 2026-10-23 01:32

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-91385: Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and 27; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).
CVE-2026-91402: Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and 27; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).

Created: 2026-10-22 Last update: 2026-10-23 01:32

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2026-10-12 Last update: 2026-10-23 02:30

lintian reports 56 warnings normal

Lintian reports 56 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-10-02 Last update: 2026-10-15 21:01

2 open merge requests in Salsa normal

There are 2 open merge requests for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2026-10-02 Last update: 2026-10-02 06:31

debian/patches: 14 patches to forward upstream low

Among the 25 debian patches available in version 21.0.12+3-3 of the package, we noticed the following issues:

14 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-10-02 18:31

news

[rss feed]

[2026-10-10] openjfx 21.0.12+3-3 MIGRATED to testing (Debian testing watch)
[2026-10-02] Accepted openjfx 21.0.12+3-3 (source) into unstable (Pierre Gruet)
[2026-09-24] Accepted openjfx 21.0.12+3-2 (source) into unstable (Pierre Gruet)
[2026-09-22] Accepted openjfx 21.0.12+3-1 (source) into unstable (Pierre Gruet)
[2026-05-11] openjfx REMOVED from testing (Debian testing watch)
[2025-04-24] openjfx 11.0.11+1-7 MIGRATED to testing (Debian testing watch)
[2025-04-13] Accepted openjfx 11.0.11+1-7 (source) into unstable (tony mancill)
[2025-02-18] openjfx 11.0.11+1-6 MIGRATED to testing (Debian testing watch)
[2025-02-12] Accepted openjfx 11.0.11+1-6 (source) into unstable (Pierre Gruet)
[2025-02-11] Accepted openjfx 11.0.11+1-5 (source) into unstable (Pierre Gruet)
[2025-02-11] Accepted openjfx 11.0.11+1-5~exp0 (source) into experimental (Pierre Gruet)
[2024-11-17] openjfx 11.0.11+1-4 MIGRATED to testing (Debian testing watch)
[2024-11-11] Accepted openjfx 11.0.11+1-4 (source) into unstable (Pierre Gruet)
[2024-04-30] openjfx 11.0.11+1-3.2 MIGRATED to testing (Debian testing watch)
[2024-04-13] Accepted openjfx 11.0.11+1-3.2 (source) into unstable (Sebastian Ramacher)
[2023-07-21] openjfx 11.0.11+1-3.1 MIGRATED to testing (Debian testing watch)
[2023-07-16] Accepted openjfx 11.0.11+1-3.1 (source) into unstable (tony mancill)
[2023-02-20] openjfx 11.0.11+1-3 MIGRATED to testing (Debian testing watch)
[2023-02-07] Accepted openjfx 11.0.11+1-3 (source) into unstable (tony mancill)
[2022-12-23] Accepted openjfx 11.0.11+1-2 (source) into unstable (tony mancill)
[2022-10-29] openjfx 11.0.11+0-1.1 MIGRATED to testing (Debian testing watch)
[2022-10-28] Accepted openjfx 11.0.11+0-1.1 (source) into testing-proposed-updates (Sebastian Ramacher)
[2022-10-16] Accepted openjfx 11.0.11+1-1.1 (source) into unstable (Philipp Kern)
[2022-05-03] Accepted openjfx 11.0.11+1-1 (source) into unstable (Emmanuel Bourg)
[2021-02-09] openjfx 11.0.11+0-1 MIGRATED to testing (Debian testing watch)
[2021-02-03] Accepted openjfx 11.0.11+0-1 (source) into unstable (Emmanuel Bourg)
[2020-10-22] openjfx 11.0.7+0-5 MIGRATED to testing (Debian testing watch)
[2020-09-21] Accepted openjfx 11.0.7+0-5 (source) into unstable (Stephen Kitt)
[2020-09-21] Accepted openjfx 11.0.7+0-5~exp2 (source) into experimental (Stephen Kitt)
[2020-09-21] Accepted openjfx 11.0.7+0-5~exp1 (source) into experimental (Stephen Kitt)

bugs [bug history graph]

all: 5
RC: 0
I&N: 4
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian (0, 56)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 11.0.11+1-7build1
1 bug (1 patch)