diff --git a/download b/download
index a3d92d63a9deb0506217f5083b74d64b44ae93f3..7eecc3894ea838f4024869b9b6394d45cd15344c 100644
--- a/download
+++ b/download
@@ -1,2 +1,2 @@
-25949f40c18348799ddb8f6143d43655  shenandoah8u442-b06.tar.xz
+fef57f31111866a2470881a03376d4a1  shenandoah8u452-b09.tar.xz
 870d829d8e1c38e251cc7498032a768a  tapsets-icedtea-3.15.0.tar.xz
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index bb0b4b6730a86e900c2506b82ad264cc7ed5e5f9..7935e6bfe066f2443b09a2bfe0d1e6944e8e16aa 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -191,7 +191,7 @@
 # Define version of OpenJDK 8 used
 %global project openjdk
 %global repo shenandoah-jdk8u
-%global openjdk_revision 8u442-b06
+%global openjdk_revision 8u452-b09
 %global shenandoah_revision shenandoah%{openjdk_revision}
 # Define IcedTea version used for SystemTap tapsets and desktop files
 %global icedteaver      3.15.0
@@ -757,7 +757,7 @@ Requires: ca-certificates
 Requires: jpackage-utils
 # 2024a required as of JDK-8325150
 # Use 2023d until 2024a is in the buildroot
-Requires: tzdata-java >= 2023d
+Requires: tzdata-java >= 2023d 
 # for support of kernel stream control
 # libsctp.so.1 is being `dlopen`ed on demand
 Requires: lksctp-tools%{?_isa}
@@ -2321,6 +2321,9 @@ require "copy_jdk_configs.lua"
 %endif
 
 %changelog
+* Mon May 19 2025 zhuhongbo <zhuhongbo@uniontech.com> - 1:1.8.0.452.b09-1
+- cve: fix CVE-2025-21587 CVE-2025-30691 CVE-2025-30698
+
 * Mon Mar 17 2025 zhuhongbo <zhuhongbo@uniontech.com> - 1:1.8.0.442.b06-1
 - fix jdk update giflib