javafix

Java certificate vulnerability (CVE-2026-91403) blocklist-based temporary mitigation tool — Windows / macOS

It finds every Java installation on your PC (Minecraft launcher, mod launchers, development tools, manually installed JDKs) and checks whether the temporary measure recommended by OpenJDK (adding the 16 affected certificates to the blocklist) has been applied. If the user agrees, it adds any missing entries. If selected, it also actually launches each Java to check whether the disguised certificate is truly rejected.

This tool is not a complete solution. It does not update Java, does not modify the trust store (cacerts), and does not enable certificate revocation checking. The fundamental fix is to update Java and your launchers to patched versions. For details, please read 3. Limitations of This Tool.

It is built using only the Rust standard library with no external libraries, so reading just the src/ and probe/ folders is enough to verify everything it does.

English: see English below.

---

Table of Contents

1. What is this vulnerability?
2. What this tool does
3. Limitations of this tool
4. Download and run
5. Screen flow
6. Meaning of the result display
7. Live connection check
8. Reverting
9. Command-line options
10. Locations checked
11. Frequently asked questions
12. Building it yourself
13. License

---

1. What is this vulnerability?

In October 2026, it was revealed that the private keys of 8 intermediate certificates from the certificate authority eMudhra could be discovered by anyone. Including the certificates cross-signed by Sectigo "AAA Certificate Services" with the same keys, that makes 16 in total.

Because unpatched Java trusts these certificates, if an attacker is on the same network (such as public Wi-Fi), they can create fake certificates impersonating any site, and Java will accept them as genuine. For example, they could impersonate the Minecraft login (session) server or a mod download server.

The measures recommended by OpenJDK are one of the following three.

Official measure	This tool
Update Java to a patched version (per Oracle/OpenJDK: 25.0.5.0.2, 21.0.13.0.2, 17.0.21.0.2, 11.0.33.0.2, 8u511 or later)	❌ Not done (guidance only)
Block the affected certificates via blocked.certs (blacklisted.certs for Java 8)	✅ Adds all 16
Enable certificate revocation checking (-Dcom.sun.net.ssl.checkRevocation=true -Dcom.sun.security.enableCRLDP=true)	❌ Not done (reason)

References

• OpenJDK security advisory: https://openjdk.org/groups/vulnerability/advisories/2026-10-21
• Oracle security alert: https://www.oracle.com/security-alerts/alert-cve-2026-91403.html
• Certificate list and test site: https://emudhra.we-have-a-problem.com/ (impacted-intermediates.json)

2. What this tool does

Step	Description	Internet
File inspection	For each Java found, read lib/security/blocked.certs (for Java 8, blacklisted.certs) and the release file to check whether the 16 certificates are on the blocklist.	Not used
Live connection test (optional)	Actually run each Java and try connecting to 2 test sites and the Mojang session server to verify that the disguised certificate is rejected. Details	Only this step uses it
Add to blocklist	Append only the missing certificate fingerprints to the end of the file. Existing lines are not deleted or modified, and the original is backed up as blocked.certs.bak-cve-2026-91403. After adding, the file is read again to verify.	Not used
Revert	Copy the backup back to its original location.	Not used

• Consent: You must enter Y before each of inspection, live connection test, adding to the blocklist, and using administrator privileges to proceed. Any other input means "no".
• Logging: Records what was inspected and changed in Windows %LOCALAPPDATA%\JavaFix and macOS ~/Library/Logs/JavaFix.
• Since only the 16 problematic certificates are blocked, there is no impact on general websites, Minecraft connections, or mod downloads.

3. Limitations of This Tool

• It does not update Java. The blocklist is a temporary measure, and if the launcher downloads Java again, it may revert to the original state.
• It does not modify the trust store (cacerts). Deleting root certificates could block legitimate sites as well, so it is left untouched. (For example, Sectigo "AAA Certificate Services" is a root used by many legitimate sites.)
• It does not enable certificate revocation checking. If enabled, it would query the revocation list server on every connection, and if that server is unreachable, even Minecraft login could fail. Also, this setting must be added as a launch option for each program, making it difficult to apply uniformly.
• "Blocklist applied" in the file inspection only means that the 16 certificates are present in the blocklist; it does not mean that Java is safe in every respect. Check actual behavior with the live connection test.
• The test sites in the live connection test check the EM DV TLS CA - G3B family (eMudhra path and Sectigo path) among the 16 as representatives. The remaining certificates are blocked in the same way and are therefore blocked as well, but each one is not connected to individually.
• Because the program is not code-signed or Apple-notarized, Windows SmartScreen and macOS Gatekeeper warnings will appear.

4. Download and Run

Download the file for your operating system from the Releases page.

Operating System	File
Windows (most PCs)	javafix-windows-x64.exe
Windows (ARM laptops)	javafix-windows-arm64.exe
macOS (Intel / Apple Silicon common)	javafix-macos-universal.zip

To verify that the downloaded file is the original, compare it with the value in SHA256SUMS.

certutil -hashfile javafix-windows-x64.exe SHA256      (Windows)
shasum -a 256 javafix-macos-universal.zip              (macOS)

Windows

1. Double-click javafix-windows-x64.exe.
2. When the "Windows protected your PC" window appears, click More info → Run anyway. This warning appears because the program does not have a code signing certificate.

macOS

1. Download javafix-macos-universal.zip and extract it (Safari extracts it automatically). A javafix-macos folder is created.
2. Double-click javafix.command inside the folder, and a terminal will open and run it.
3. Because the program is not notarized by Apple, an "unidentified developer" warning appears the first time.
   • macOS 15 (Sequoia) or later: Close the warning window, go to System Settings → Privacy & Security, click "Open Anyway" at the very bottom, then double-click again.
   • macOS 14 or earlier: Right-click javafix.command → Open → Open.

To run it directly from the terminal:

cd ~/Downloads/javafix-macos
xattr -d com.apple.quarantine javafix.command
./javafix.command

The uncompressed javafix-macos-universal file for v0.1.0 loses its execute permission when downloaded, so double-clicking it causes the text editor to show the error "The text encoding Unicode (UTF-8) is not applicable." Starting with v0.1.1, it is distributed as a zip.

5. Order of the Execution Screens