CVE-2016-5597

from the upstream release notes:
In some environments, certain authentication schemes
may be undesirable when proxying HTTPS. Accordingly,
the Basic authentication scheme has been deactivated, by
default, in the Oracle Java Runtime, by adding Basic to the
jdk.http.auth.tunneling.disabledSchemes networking property. Now,
proxies requiring Basic authentication when setting up a tunnel
for HTTPS will no longer succeed by default. If required, this
authentication scheme can be reactivated by removing Basic from
the jdk.http.auth.tunneling.disabledSchemes networking property,
or by setting a system property of the same name to "" ( empty )
on the command line.
.
Additionally, the jdk.http.auth.tunneling.disabledSchemes and
jdk.http.auth.proxying.disabledSchemes networking properties,
and system properties of the same name, can be used to disable
other authentication schemes that may be active when setting up
a tunnel for HTTPS, or proxying plain HTTP, respectively.