<html><body><div dir="ltr" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Hello,</div><div dir="ltr" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br></div><div dir="ltr" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">after the October Java update we noticed a few regression issues with saved X509 certificates. In our system we need to correlate CMS objects which reference certificates with Issuer+SN. We had stored the certificates in the DB and some could no longer be found.</div><div dir="ltr" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br></div><div dir="ltr" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">This is caused by the improved encoding handling in CVE-2025-53056 / JDK-8360937</div><div dir="ltr" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><a href="https://github.com/openjdk/jdk21u/commit/643330569baa7c835c2970f0272e9c83883d2a31" rel="noreferrer noopener">https://github.com/openjdk/jdk21u/commit/643330569baa7c835c2970f0272e9c83883d2a31</a></div><div dir="ltr"><br></div><div dir="ltr" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">The certificate (issuers) in questions seem to be mostly self signed hierarchies. We have seen both BMPSTRINGS (containing \0 characters) and T61STRINGS (probably containing national characters escapes). I think the new behavior is better (although the T61 handling seems incomplete?), we will refresh the database entries, just thought somebody appreciates the warning,</div><div dir="ltr" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><br></div><div id="ms-outlook-mobile-body-separator-line" data-applydefaultfontstyles="true" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt;" dir="ltr"><div dir="ltr" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt;"><br></div></div><div style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt;" id="ms-outlook-mobile-signature"><span style="font-family: Aptos; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">Gruß,</span><div dir="ltr" style="text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); font-family: Aptos; font-size: 12pt; color: rgb(0, 0, 0);">Bernd</div><div dir="ltr" style="text-align: left; text-indent: 0px; background-color: rgb(255, 255, 255); font-family: Aptos; font-size: 12pt; color: rgb(0, 0, 0);">-- </div><div style="font-family: Aptos; font-size: 12pt; color: rgb(0, 0, 0);"><span style="background-color: rgb(255, 255, 255);">https://bernd.eckenfels.net</span></div></div></body></html>