# JRE 24 vulnerability

**URL:** <https://discuss.elastic.co/t/jre-24-vulnerability/380981>\
**Category:** Elasticsearch\
**Created:** [August 12, 2025, 10:33pm UTC](https://discuss.elastic.co/t/jre-24-vulnerability/380981 "2025-08-12T22:33:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![BS1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bs1/32/1718_2.png) [@BS1](https://discuss.elastic.co/u/BS1)\
**Post date:** [August 12, 2025, 10:33pm UTC](https://discuss.elastic.co/t/jre-24-vulnerability/380981/1 "2025-08-12T22:33:55Z")

</div>

The Java 24 version bundled with all recent versions of Elasticsearch has three vulnerabilities, all published on April 15th

[CVE-2025-21587](https://nvd.nist.gov/vuln/detail/CVE-2025-21587) Score 7.4 High  
[CVE-2025-30691](https://nvd.nist.gov/vuln/detail/CVE-2025-30691) Score 4.8 Medium  
[CVE-2025-30698](https://nvd.nist.gov/vuln/detail/CVE-2025-30698) Score 5.6 Medium

We’ve been following new releases hoping to patch this to make sure we are compliant, but even most recent 8.18.5 version, released yesterday, has no mention of a new bundled OpenJDK in the [release notes](https://www.elastic.co/guide/en/elasticsearch/reference/8.18/release-notes-8.18.5.html).

OpenJDK 24.0.2 was released on [July 15th](https://www.oracle.com/java/technologies/javase/24all-relnotes.html).

When can we expect a new version of Elasticsearch to released with a vulnerability free Java ?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [August 13, 2025, 4:29am UTC](https://discuss.elastic.co/t/jre-24-vulnerability/380981/2 "2025-08-13T04:29:39Z")

</div>

Thank you for this question.

Elastic's security reporting guidelines are available at [Security issues | Elastic](https://www.elastic.co/community/security) .

Per those guidelines, all reports of potential security issues or vulnerabilities should be sent via email to [security@elastic.co](mailto:security@elastic.co).

We are unable to discuss potential issues of this nature here. Please send your report to the email address above, where it can be appropriately handled.

---

<div class="post-metadata">

**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\
**Post date:** [August 13, 2025, 8:01am UTC](https://discuss.elastic.co/t/jre-24-vulnerability/380981/3 "2025-08-13T08:01:36Z")

</div>

++ to what @dadoonet says, but also [see these docs](https://www.elastic.co/docs/deploy-manage/deploy/self-managed/installing-elasticsearch#jvm-version):

> Elasticsearch uses only a subset of the features offered by the JVM. Bugs and security issues in the bundled JVM often relate to features that Elasticsearch does not use. Such issues do not apply to Elasticsearch. Elastic analyzes reports of security vulnerabilities in all its dependencies, including in the bundled JVM, and will issue an [Elastic Security Advisory](https://www.elastic.co/community/security) if such an advisory is needed.