Security Vulnerabilities in OpenJDK based Java runtimes

Problem Description

Does the COMSOL software contain an OpenJDK™ based Java runtime and, if so, is it affected by known security vulnerabilities in OpenJDK? Can a newer OpenJDK based Java runtime version be used before the next COMSOL product update?

Solution

Summary

The COMSOL software includes an OpenJDK based Java runtime that is used by COMSOL Multiphysics®, COMSOL Server™, Model Manager server, and other COMSOL software components.

Install the latest product updates for the COMSOL software to also update its bundled Java runtime. If needed, see below for more information about Java security vulnerabilities, the OpenJDK version bundled with each supported COMSOL version, and how to use a custom OpenJDK based Java runtime.

Security vulnerabilities

Security vulnerabilities affecting OpenJDK based Java runtimes are listed by the OpenJDK Vulnerability Group on the OpenJDK Vulnerability Advisories page.

Not all security vulnerabilities of OpenJDK apply to the COMSOL software, since the COMSOL software does not use all Java runtime functionality and may not have enabled the affected features.

Vulnerability assessments

The following notable vulnerabilities are fixed in the latest security updates of OpenJDK but not in the versions that are bundled with the latest supported COMSOL versions:

• CVE-2026-114820, CVE-2026-91403
  Assessment: Affected
  These vulnerabilities affect eMudhra certificates trusted by the Java runtime. To work around the vulnerabilities, either follow the general instructions under Using a newer OpenJDK runtime below to use a custom Java runtime, or the specific instructions under eMudhra certificate security issue to patch an older Java runtime.

Using a newer OpenJDK runtime

A custom OpenJDK based Java runtime can be used if it meets the applicable system requirements:

• COMSOL 6.4: Java 21 version 21.0.7 or later
• COMSOL 6.3: Java 11 version 11.0.24 or later

The COMSOL software includes OpenJDK based Java runtimes from the Eclipse Temurin project. Newer Eclipse Temurin runtimes can be obtained from the Eclipse Temurin releases page. Select the applicable Java version and operating system, and select JRE as the package type. Other OpenJDK based runtimes meeting the applicable system requirements can also be used.

To use a custom Java runtime, launch the COMSOL installer, select a custom Java runtime instead of the built-in Java runtime, and specify the location of the custom runtime.

Note: Compatibility between the COMSOL software and new OpenJDK runtime versions cannot be guaranteed until they have been tested. If you use a custom Java runtime and encounter issues, please check whether the issue also occurs with the built-in runtime and contact COMSOL Support if needed.

eMudhra certificate security issue

In October 2026, it was disclosed that private keys corresponding to several eMudhra intermediate CA certificates had been compromised. Java security updates address this issue by distrusting the affected certificates and removing the relevant root certificates from the Java trust store. If updating to a custom Java runtime is not practical, the affected certificates can instead be removed from the trust store of the Java runtime used by the COMSOL software.

1. Find the path to the Java keytool.

   • On Linux systems, the default path for COMSOL Multiphysics 6.4 is /usr/local/comsol64/multiphysics/java/glnxa64/jre/bin/keytool.
   • On macOS systems, the default path is /Applications/COMSOL64/Multiphysics/java/maci64/jre/bin/keytool.
   • On Windows systems, the default path is C:\Program Files\COMSOL\COMSOL64\Multiphysics\java\win64\jre\bin\keytool.exe.
   • Replace glnxa64 and maci64 with glnxarm64 and macarm64, respectively, on ARM64 based platforms.

2. Run keytool -list -cacerts and locate the aliases of the affected root certificates listed in the Eclipse Temurin eMudhra CA advisory. For the Java runtimes distributed with COMSOL, the aliases to remove are the following:

   • COMSOL 6.4:
     emSign ECC Root CA - G3: cn_emsign_ecc_root_ca__g3,o_emudhra_technologies_limited,ou_emsign_pki,c_in [jdk]
   • COMSOL 6.3:
     emSign ECC Root CA - G3: cn=emsign_ecc_root_ca_-_g3,o=emudhra_technologies_limited,ou=emsign_pki,c=in
     AAA Certificate Services: cn=aaa_certificate_services,o=comodo_ca_limited,l=salford,st=greater_manchester,c=gb

3. For each affected root certificate, run keytool -delete -cacerts -alias "alias", replacing the quoted alias value with the applicable alias listed above, or with the alias shown by keytool -list -cacerts for another Java runtime. You need to run the commands with permissions to write to the installation directory.

4. Enter the password of the Java cacerts file which is by default changeit.

Note: There might be other COMSOL software installed on the system. Take care to locate each COMSOL software installation and version that you use, and run the keytool from the Java runtime of that installation.

You can verify that an alias has been removed by running keytool -list -cacerts -alias "alias". If the entry has been successfully removed, keytool reports that the alias does not exist.

After removing the certificates, restart the COMSOL software.

OpenJDK version

The following OpenJDK versions are included with the latest updates of the currently supported COMSOL versions:

• COMSOL 6.4 Update 3: OpenJDK 21.0.11
• COMSOL 6.3 Update 3: OpenJDK 11.0.24

In general, the OpenJDK version included with a particular COMSOL software installation can be determined by running the java executable included in the COMSOL installation with the -version option:

1. Find the path to the java command that is included in the COMSOL software installation.
   • On Linux systems, the default path for COMSOL Multiphysics 6.4 is /usr/local/comsol64/multiphysics/java/glnxa64/jre/bin/java.
   • On macOS systems, the default path is /Applications/COMSOL64/Multiphysics/java/maci64/jre/bin/java.
   • On Windows systems, the default path is C:\Program Files\COMSOL\COMSOL64\Multiphysics\java\win64\jre\bin\java.exe.
   • Replace glnxa64 and maci64 with glnxarm64 and macarm64, respectively, on ARM64 based platforms.
2. Run java -version. The output will include a version string such as openjdk version "21.0.11".

種類ごとに閲覧