https://bugzilla.redhat.com/show_bug.cgi?id=1594313
--- Comment #24 from Severin Gehwolf sgehwolf@redhat.com --- CDDL is from the hotspot ideal graph visualizer: $ grep CDDL review-java-11-openjdk/licensecheck.out /var/lib/mock/fedora-28-x86_64/root/builddir/build/BUILD/java-11-openjdk-11.0.ea.19-1.fc28.x86_64/openjdk/src/utils/IdealGraphVisualizer/View/src/com/sun/hotspot/igv/view/actions/CustomizablePanAction.java: CDDL
That's not part of the binary packages.