Alert: Oracle JRE 25 (jrt-fs.jar) Detected in Official Elasticsearch 8.19.5 Docker Image

Elastic Stack Elasticsearch
1

After a recent internal security review, we received an alert regarding the official Elasticsearch 8.19.5 Docker image. The report indicates the presence of a vulnerable component — Oracle JRE 25 (jrt-fs.jar).

Here are the details from our scan:

  • Elasticsearch version: 8.19.5
  • Base JDK: OpenJDK 25 (as bundled in the official image)
  • Flagged file: /usr/share/elasticsearch/jdk/lib/jrt-fs.jar
  • Detected component: Oracle JRE 25 – Java Runtime Environment
  • Alert: "Oracle Java must be removed unless the vendor provides a valid license. In such cases, update the system to the latest version of Azul Java instead."

My understanding is that Elasticsearch uses a bundled OpenJDK distribution, so we’re trying to understand why the scan reports this Oracle JRE reference. Could you please clarify:

  1. Is the inclusion of jrt-fs.jar with Oracle JRE metadata expected in the official OpenJDK-based image?

  2. Has Elastic verified whether this file (or version metadata) actually poses any security risk?

  3. Does Elasticsearch have a valid license in place for this usage?

  4. Is there an updated or alternate Elasticsearch Docker image that eliminates this detection?

We want to ensure our deployment of Elasticsearch 8.19.5 remains compliant with internal security requirements and to confirm whether this is a false positive or an issue needing remediation.

Thank you for your help and clarification.

Best regards,
Elex

2

Welcome!

Thank you for your report.

Elastic's security reporting guidelines are available at Security issues | Elastic.

Per those guidelines, all reports of potential security issues or vulnerabilities should be sent via email to security@elastic.co.

We are unable to discuss potential issues of this nature here. Please send your report to the email address above, where it can be appropriately handled.

3

I am not commenting on the security aspects of this question, you need to ask them in private, but the alert itself is simply bogus. The file in question is exactly the one that comes with OpenJDK 25:

$ tar xf openjdk-25_linux-x64_bin.tar.gz && shasum jdk-25/lib/jrt-fs.jar
c8f8b74577537b8dc22e004a9e1464f88db1ccad  jdk-25/lib/jrt-fs.jar
$ tar xf elasticsearch-8.19.5-linux-x86_64.tar.gz && shasum elasticsearch-8.19.5/jdk/lib/jrt-fs.jar
c8f8b74577537b8dc22e004a9e1464f88db1ccad  elasticsearch-8.19.5/jdk/lib/jrt-fs.jar
1 Like