Repository navigation
A vulnerable JBR 25 version is selected #1317
Description
Description:
When I use this:
uses: actions/setup-java@v6
with:
distribution: 'jetbrains'
java-version: '25'
it downloads 25.0.4+508.27, which has a vulnerability with eMudhra root certificate.
It is patched in 25.0.4.1+635.79, but this version is rejected
Task version:
v6
Platform:
- Ubuntu
- macOS
- Windows
Runner type:
- Hosted
- Self-hosted
Repro steps:
Run this workflow, see the printed version:
name: Reproduce JBR 25 selection
on:
workflow_dispatch:
jobs:
repro:
runs-on: ubuntu-24.04
steps:
- uses: actions/setup-java@v6
with:
distribution: jetbrains
java-version: '25'
check-latest: true
env:
GITHUB_TOKEN: ${{ github.token }}
- run: java -version
Expected behavior:
25.0.4.1+635.79 is selected
Actual behavior:
25.0.4+508.27 is selected
Activity
v-mahabaleshwars commentedon Nov 9, 2026
Hi @igordmn,
Thank you for creating this issue. We will investigate it and provide feedback as soon as we have some updates.