Key: JDK-X - https://bugs.openjdk.java.net/browse/JDK-X CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY New in release OpenJDK 25.0.4 (2026-07-21): =========================================== Live versions of these release notes can be found at: * https://bit.ly/openjdk2504 * CVEs * Changes - JDK-7184899: Test sun/java2d/X11SurfaceData/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail - JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes fails - JDK-8064922: [macos] Test javax/swing/JTabbedPane/4624207/bug4624207.java fails - JDK-8068293: [TEST_BUG] Test closed/com/sun/java/swing/plaf/motif/InternalFrame/4150591/bug4150591.java fails with GTKLookAndFeel - JDK-8068310: [TEST_BUG] Test javax/swing/JColorChooser/Test4234761.java fails with GTKL&F - JDK-8144124: [macosx] The tabs can't be aligned when we pressing the key of 'R','B','L','C' or 'T'. - JDK-8203004: UnixMultiResolutionSplashTest.java fails on Ubuntu16.04 - JDK-8213530: Test java/awt/Modal/ToFront/DialogToFrontModeless1Test.java fails on Linux - JDK-8221451: PIT: sun/java2d/X11SurfaceData/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fails - JDK-8225787: java/awt/Window/GetScreenLocation/GetScreenLocationTest.java fails on Ubuntu - JDK-8241066: Shenandoah: fix or cleanup SH::do_full_collection - JDK-8261743: Shenandoah: enable String deduplication with compact heuristics - JDK-8264851: Shenandoah: Rework control loop mechanics to use timed waits - JDK-8278102: containers/docker/TestJcmd.java failed with "RuntimeException: Could not find specified process" - JDK-8279196: Test: jdk/jfr/event/gc/stacktrace/TestG1OldAllocationPendingStackTrace.java timed out - JDK-8297191: [macos] Printing a page range with starting page > 1 results in missing pages - JDK-8298823: [macos] java/awt/Mouse/EnterExitEvents/DragWindowTest.java continues to fail with "No MouseReleased event on label!" - JDK-8319326: GC: Make TestParallelRefProc use createTestJavaProcessBuilder - JDK-8319540: GC: Make TestSelectDefaultGC use createTestJavaProcessBuilder - JDK-8321303: Intermittent open/test/jdk/java/awt/KeyboardFocusmanager/ConsumeNextMnemonicKeyTypedTest/ConsumeNextMnemonicKeyTypedTest.java failure on Linux - JDK-8321687: Test vmTestbase/nsk/jvmti/scenarios/contention/TC03/tc03t002/TestDescription.java failed: JVMTI_ERROR_THREAD_NOT_ALIVE - JDK-8323792: ThreadSnapshot::initialize can cause assert in Thread::check_for_dangling_thread_pointer (possibility of dangling Thread pointer) - JDK-8325482: Test that distinct seeds produce distinct traces for compiler stress flags - JDK-8335355: Shenandoah: Fix race condition in gc/shenandoah/mxbeans/TestPauseNotifications.java - JDK-8339526: C2: store incorrectly removed for clone() transformed to series of loads/stores - JDK-8340182: Java HttpClient does not follow default retry limit of 3 retries - JDK-8341735: Rewrite the build/AbsPathsInImage.java test to not load the entire file at once - JDK-8344345: test/hotspot/gtest/x86/x86-asmtest.py has trailing whitespaces - JDK-8345631: TestRegionSamplingLogging.java#generational-rotation intermittent fails - JDK-8347167: Reduce allocation in com.sun.net.httpserver.Headers::normalize - JDK-8347938: Add Support for the Latest ML-KEM and ML-DSA Private Key Encodings - JDK-8351010: Test java/io/File/GetXSpace.java failed: / usable space 56380809216 > free space 14912244940 - JDK-8352914: Shenandoah: Change definition of ShenandoahSharedValue to int32_t to leverage platform atomics - JDK-8353115: GenShen: mixed evacuation candidate regions need accurate live_data - JDK-8354650: [PPC64] Try to reduce register definitions - JDK-8355339: Test java/io/File/GetCanonicalPath.java failed: The specified network name is no longer available - JDK-8357086: os::xxx functions returning memory size should return size_t - JDK-8358600: Template-Framework Library: Template for TestFramework test class - JDK-8358772: Template-Framework Library: Primitive Types - JDK-8359083: Test jdkCheckHtml.java should report SkippedException rather than report fails when miss tidy - JDK-8359223: HttpClient: Remove leftovers from the SecurityManager cleanup - JDK-8359412: Template-Framework Library: Operations and Expressions - JDK-8359433: The final modifier on Windows L&F internal UI classes prevents extending them in apps - JDK-8361339: Test gc/shenandoah/TestLargeObjectAlignment.java#generational fails on macOS aarch64 with OOM: Java heap space - JDK-8361606: ConsumeNextMnemonicKeyTypedTest.java fails on Windows: character typed with VK_A: a - JDK-8361699: C2: assert(can_reduce_phi(n->as_Phi())) failed: Sanity: previous reducible Phi is no longer reducible before SUT - JDK-8361726: Shenandoah: More detailed evacuation instrumentation - JDK-8362428: Update IANA Language Subtag Registry to Version 2025-08-25 - JDK-8363943: ARM32: Represent Registers as values - JDK-8363949: Incorrect jtreg header in MonitorWithDeadObjectTest.java - JDK-8363986: Heap region in CDS archive is not at deterministic address - JDK-8364315: Remove unused xml files from test/jaxp/javax/xml/jaxp/functional/javax/xml/transform/xmlfiles - JDK-8364657: Crash for SecureRandom.generateSeed(0) on Windows x86-64 - JDK-8364927: Add @requires annotation to TestReclaimStringsLeaksMemory.java - JDK-8365057: Add support for java.util.concurrent lock information to Thread.dump_to_file - JDK-8365379: SU3.applyInsets may produce wrong results - JDK-8365423: [macos26] java/awt/MenuBar/8007006/bug8007006.java fails on macOS 26 - JDK-8365424: [macos26] java/awt/Frame/DisposeTest.java fails on macOS 26 - JDK-8365623: test/jdk/sun/security/pkcs11/tls/ tests skipped without skip exception - JDK-8365625: Can't change accelerator colors in Windows L&F - JDK-8365792: GenShen: assertion "Generations aren't reconciled" - JDK-8366692: Several gc/shenandoah tests timed out - JDK-8366695: Test sun/jvmstat/monitor/MonitoredVm/MonitorVmStartTerminate.java timed out - JDK-8366852: java/awt/Choice/ChoiceMouseWheelTest/ChoiceMouseWheelTest.java test is failing - JDK-8367096: jdk/open/test/jdk/sun/security/pkcs11/ rsa, ec, config, secmod and sslecc tests are skipping but showing as pass - JDK-8367450: Shenandoah: Log the composition of the collection set - JDK-8367451: GenShen: Remove the option to compute age census during evacuation - JDK-8367473: Shenandoah: Make the detailed evacuation metrics a runtime diagnostic option - JDK-8367485: os::physical_memory is broken in 32-bit JVMs when running on 64-bit OSes - JDK-8367531: Template Framework: use scopes and tokens instead of misbehaving immediate-return-queries - JDK-8367646: [GenShen] Control thread may overwrite gc cancellation cause set by mutator - JDK-8367708: GenShen: Reduce total evacuation burden - JDK-8367709: GenShen: Dirty cards for objects that get promoted by safepoint that intervenes between allocation and stores - JDK-8367722: [GenShen] ShenandoahEvacuationStats is always empty - JDK-8367949: JFR: MethodTrace double-counts methods that catch their own exceptions - JDK-8368001: java/text/Format/NumberFormat/NumberRoundTrip.java timed out - JDK-8368015: Shenandoah: fix error in computation of average allocation rate - JDK-8368041: Enhance TLS certificate handling - JDK-8368159: Significant performance overhead when started with jdwp agent and unattached debugger - JDK-8368181: ProblemList java/awt/Dialog/ModalExcludedTest/ModalExcludedTest.java - JDK-8368307: Shenandoah: get_next_bit_impl should special case weak and strong mark bits - JDK-8368499: GenShen: Do not collect age census during evac when adaptive tenuring is disabled - JDK-8368501: Shenandoah: GC progress evaluation does not use generation - JDK-8368524: Tests are skipped and shown as passed in test/jdk/sun/security/pkcs11/Cipher/KeyWrap - JDK-8368681: Shenandoah: Add documentation comments for ShenandoahAllocationRate - JDK-8369128: ProblemList jdk/jfr/event/profiling/TestCPUTimeSampleQueueAutoSizes.java in Xcomp configs - JDK-8369132: Disable vmTestbase/gc/vector/CircularListLow and LinearListLow with SerialGC - JDK-8369133: Disable gc/g1/TestShrinkAuxiliaryDataRunner.java with UseLargePages option - JDK-8369251: Opensource few tests - JDK-8369561: sun/java2d/OpenGL/DrawBitmaskImage.java#id0: Incorrect color for first pixel (actual=ff000000) - JDK-8369683: Exclude runtime/Monitor/MonitorWithDeadObjectTest.java#DumpThreadsBeforeDetach on Alpine Linux debug - JDK-8369736: Add management interface for AOT cache creation - JDK-8369817: [TESTBUG] EmptyPath::toString is ignored - JDK-8369912: [TESTBUG] testlibrary_tests/template_framework/examples/TestExpressions.java fails with ArithmeticException: / by zero - forgot to respect Expression.info - JDK-8369950: TLS connection to IPv6 address fails with BCJSSE due to IllegalArgumentException - JDK-8370370: Add still more cases to WorstCaseTests - JDK-8370489: Some compiler tests miss the @key randomness - JDK-8370502: C2: segfault while adding node to IGVN worklist - JDK-8370521: GenShen: Various code cleanup related to promotion - JDK-8370939: C2: SIGSEGV in SafePointNode::verify_input when processing MH call from Compile::process_late_inline_calls_no_inline() - JDK-8371284: GenShen: Avoid unnecessary card marking - JDK-8371381: [Shenandoah] Setting ergo flags should use FLAG_SET_ERGO - JDK-8371503: RETAIN_IMAGE_AFTER_TEST do not work for some tests - JDK-8371792: Refactor barrier loop tests out of TestIfMinMax - JDK-8371893: [macOS] use dead_strip linker option to reduce binary size - JDK-8372272: Hotspot shared lib loading - add load attempts to Events::log - JDK-8372351: Add 2 WISeKey roots - JDK-8372380: Make hs_err reporting more robust for unattached threads - JDK-8372513: Shenandoah: ShenandoahMaxRegionSize can produce an unaligned heap alignment - JDK-8372851: Modify java/io/File/GetXSpace.java to print path on failure of native call - JDK-8372861: Genshen: Override parallel_region_stride of ShenandoahResetBitmapClosure to a reasonable value for better parallelism - JDK-8373039: Remove Incorrect Asserts in shenandoahScanRemembered - JDK-8373120: Virtual thread stuck in BLOCKED state - JDK-8373239: Test java/awt/print/PrinterJob/PageRanges.java fails with incorrect selection of printed pages - JDK-8373275: Improve DTLS handshaking - JDK-8373515: Migrate "test/jdk/java/net/httpclient/" to null-safe "SimpleSSLContext" methods - JDK-8373579: Problem list compiler/runtime/Test7196199.java - JDK-8373650: Test "javax/swing/JMenuItem/6458123/ManualBug6458123.java" fails because the check icons are not aligned properly as expected - JDK-8373676: Test javax/net/ssl/HttpsURLConnection/SubjectAltNameIP.java fails on a machine without IPV6 - JDK-8373690: Unexpected Keystore message using jdk.crypto.disabledAlgorithms - JDK-8373714: Shenandoah: Register heuristic penalties following a degenerated GC - JDK-8373718: jdk/internal/misc/VM/RuntimeArguments.java test fails in Virtual threads mode - JDK-8373796: Refactor java/net/httpclient/ThrowingPublishers*.java tests to use JUnit5 - JDK-8373847: Test javax/swing/JMenuItem/MenuItemTest/bug6197830.java failed because The test case automatically fails when clicking any items in the “Nothing” menu in all four windows (Left-to-right)-Menu Item Test and (Right-to-left)-Menu Item Test - JDK-8373866: Refactor java/net/httpclient/ThrowingSubscribers*.java tests to use JUnit5 - JDK-8373893: Refactor networking http server tests to use JUnit - JDK-8373913: Refactor serialization tests to use JUnit - JDK-8373928: 4 Dangling pointer defect groups in java.c - JDK-8374001: sun/security/ skip without Exceptions - JDK-8374058: Enhance JPEG handling - JDK-8374168: Resolve disabled warnings in JDWP agent - JDK-8374304: MultiResolutionSplashTest.java fails in CI: "Image with wrong resolution is used for splash screen!" - JDK-8374322: TestMemoryWithSubgroups.java fails Permission denied - JDK-8374343: Fix SIGSEGV when lib/modules is unreadable - JDK-8374449: Shenandoah: Leaf locks used by Shenandoah need lower ranks - JDK-8374506: Incorrect positioning of arrow icon in parent JMenu in Windows L&F - JDK-8374712: AOTMappedHeapWriter::relocate_field_in_buffer should use CompressedOops::narrow_oop_cast - JDK-8374727: Audio configuration Platform class - use nio for getting endianness of the underlying platform - JDK-8374744: Enable dumping of APX EGPRs (R16–R31) in JVM fatal error logs - JDK-8374769: PPC: MASM::pop_cont_fastpath() should reset _cont_fastpath if SP == _cont_fastpath - JDK-8374888: Implement internal test cache to help UserIterCount test performance - JDK-8374998: Failing os::write - remove bad file - JDK-8375065: Update LCMS to 2.18 - JDK-8375177: Gtest os_linux.decoder_get_source_info_valid_vm fails with -ffunction-sections - JDK-8375294: (fs) Files.copy can fail with EOPNOTSUPP when copy_file_range not supported - JDK-8376031: HttpsURLConnection.getServerCertificates() throws "java.lang.IllegalStateException: connection not yet open" for the HEAD method - JDK-8376104: C2 crashes in PhiNode::Ideal(PhaseGVN*, bool) accessing NULL pointer - JDK-8376151: Test javax/swing/JFileChooser/4966171/bug4966171.java is failing with OOME - JDK-8376152: Test javax/sound/sampled/Clip/bug5070081.java timed out then completed - JDK-8376185: NoSuchFieldError thrown after a record with type annotation retransformed - JDK-8376233: Clean up code in Desktop native peer - JDK-8376287: Crashes when using -XX:ObjArrayMarkingStride=0 - JDK-8376402: Dependencies::print_statistics() and AbstractClassHierarchyWalker::print_statistics() are not called from PRODUCT code - JDK-8376684: Compile OpenJDK in headless mode without required X11 libraries - JDK-8376956: Add JVMTI phase entering/setting to hserr event log - JDK-8376969: Shenandoah: GC state getters should be inlineable - JDK-8376970: Shenandoah: Verifier should do basic verification before touching oops - JDK-8377158: Enhance XBM image support - JDK-8377167: javax/imageio/ReadAbortTest.java throw NPE when x11 unavailable - JDK-8377498: Improve HttpServer handling - JDK-8377512: AOT cache creation fails with invalid native pointer - JDK-8377602: Create automated test for PageRange - JDK-8377727: Ghost caret and focus appear in non‑editable text fields - JDK-8377833: Enhance Jar file processing - JDK-8377907: (process) Race in ProcessBuilder can cause JVM hangs - JDK-8377910: Minor cleanup of java/io/FileDescriptor/Sharing.java - JDK-8377932: AOT cache is not rejected when JAR file has changed - JDK-8377944: LowMemoryTest2.java#id1 intermittent fails OOME: Metaspace - JDK-8377949: TestZRelocationSetEvent.java intermittent fails OOME - JDK-8378083: Mark shenandoah/generational/TestOldGrowthTriggers.java as flagless - JDK-8378201: [OGL] glXMakeContextCurrent() drops the buffers of the unbound drawable - JDK-8378417: Printing All pages results in NPE for 1.1 PrintJob - JDK-8378561: Mark gc/shenandoah/compiler/TestLinkToNativeRBP.java as /native - JDK-8378687: Improve delegation of HttpURLConnection - JDK-8378727: [macOS] Missing dispatch_release for semaphores in CDesktopPeer - JDK-8378746: ZGC: jdk/jfr/event/gc/detailed/TestZRelocationSetGroupEvent.java intermittent OOME - JDK-8378764: fileStream::fileSize() fails for >2GB files on Windows - JDK-8378774: Bump update version for OpenJDK: jdk-25.0.4 - JDK-8378810: Enable missing FFM test via jtreg requires for RISC-V - JDK-8378836: Enable linktime-gc by default on Linux ppc64le - JDK-8378878: Refactor java/nio/channels/AsynchronousSocketChannel test to use JUnit - JDK-8378888: jdk/incubator/vector/Float16OperationsBenchmark.java uses wrong package name - JDK-8379021: Shenandoah: Speedup ShenandoahSimpleBitMapTest - JDK-8379202: Support linktime-gc on Linux with clang - JDK-8379416: AIX build fails if system (not GNU) date tool is in PATH - JDK-8379425: Windows and macOS should not allow unsupported headless-only build - JDK-8379457: Test EATests.java#id0 ERROR: monitor list errors: error_cnt=1 - JDK-8379464: Enable missing stack walking test via jtreg requires for RISC-V - JDK-8379499: [AIX] headless-only build of libjawt.so fails - JDK-8379515: draft-ietf-lamps-kyber-certificates is now RFC 9935 - JDK-8380011: Path-to-gcroots search should not trigger stack overflows - JDK-8380041: PPC: remove POWER6 remnants - JDK-8380222: Refactor test/jdk/java/lang/Character TestNG tests to JUnit - JDK-8380316: Test runtime/os/AvailableProcessors.java fails Invalid argument - JDK-8380409: JVM crashes when -XX:AOTMode=create uses app.aotconf generated with JVMTI agent - JDK-8380428: ProblemList containers/docker/TestJcmdWithSideCar.java on linux-all - JDK-8380431: Shenandoah: Concurrent modification of stack-chunk objects during evacuation - JDK-8380474: Crash SEGV in ThreadIdTable::lazy_initialize after JDK-8323792 - JDK-8380565: PPC64: deoptimization stub should save vector registers - JDK-8380663: Update jcmd man page to include AOT.end_recording diagnostic command - JDK-8380672: Improve certification checking - JDK-8380846: GenShen: Remove the experimental option to disable adaptive tenuring - JDK-8380947: Add pull request template - JDK-8381039: Enhance AWT ImagingLib - JDK-8381049: Enhance Jar handling - JDK-8381205: GHA: Upgrade Node.js 20 to 24 - JDK-8381315: compiler/vectorapi/TestVectorReallocation.java fails with -XX:UseAVX=1 after JDK-8380565 - JDK-8381382: Shenandoah: assert(capacity > 0) failed: free regions must have allocation capacity - JDK-8381519: Enhance Der Value Handling - JDK-8381796: Enhance Certificate parsing - JDK-8381871: GenShen: ShenandoahGCHeuristics flag not reset after ignoring non-adaptive value - JDK-8381935: Improve numChunks range in the PPC64 CallAranger - JDK-8381937: Make exceptions in Java_sun_security_mscapi_CKeyPairGenerator generateCKeyPair more specific - JDK-8382018: test/jdk/java/nio/file/spi/SetDefaultProvider.java leaves a directory in /tmp - JDK-8382020: Time Zone Abbreviation Not Localized for Non-English Locales - JDK-8382035: [ubsan] Under UBSAN builds, disable tests that rely on simulated JVM crashes - JDK-8382090: Remove .rej and .orig from .gitignore - JDK-8382242: JFR: Metadata reconstruction invalidates ConstantMap for java.lang.String - JDK-8382295: Shenandoah: wrong denominator in full gc summary - JDK-8382395: Disable stringop-overflow in shenandoahGenerationalHeap.cpp - JDK-8382419: Add missed @key randomness after JDK-8370489 - JDK-8382522: Disable stringop-overflow in safepointMechanism.cpp - JDK-8382740: JFR: Disable jdk.OldObjectSample event for generational ZGC - JDK-8382878: RISC-V: Missing InlineSkippedInstructionsCounter in ZGC barriers stubs - JDK-8382932: [25u] Test java/lang/instrument/RetransformRecordTypeAnn/TestRetransformRecord.java‎ fails with compilation error - JDK-8383161: [PPC64] MachCallDynamicJavaNode::ret_addr_offset() needs adaptation for COH - JDK-8383175: (tz) Update Timezone Data to 2026b - JDK-8383183: Shenandoah: Mangle trashed regions up to top instead of end - JDK-8383354: Update LCMS to 2.19.1 - JDK-8383473: Follow on from tzdata2026b time change to include temporary hack BC time change - JDK-8383601: RISC-V: ShenandoahBarrierSetAssembler::load_reference_barrier calls "weak" on "phantom" path - JDK-8383630: Fix iteration in tests doing class redefinition - JDK-8384043: [REDO] Incorrect handling of Hawaii_Aleutian metazone - JDK-8384158: GHA: Downgrade Windows GHA runners to windows-2022 temporarily - JDK-8384163: (so) SocketChannel.connect and finishConnect() exception messages could be improved - JDK-8384223: RISC-V: entry_barrier_offset should consider UseZtso - JDK-8384486: NTLM tests fail on Windows 11 and Windows Server 2025 - JDK-8384495: Update Libpng to 1.6.58 - JDK-8384540: [25u, 21u, 17u] Update GHA JDKs after Apr/26 updates - JDK-8384815: SelectOneKeyOutOfMany and PreferredKey fail after expired test certificate - JDK-8384902: Update GIFlib to 6.1.3 - JDK-8385390: Update FreeType to 2.14.3 - JDK-8385490: Update HarfBuzz to 14.2.0 - JDK-8386551: Windows build broken because of MSys2/Make update Notes on individual issues: =========================== hotspot/svc: JDK-8365057: Add support for java.util.concurrent lock information to Thread.dump_to_file ========================================================================================= An AbstractOwnableSynchronizer lock object has a notion of exclusive ownership by a particular thread. When another thread is parked waiting on this lock, this information is now obtained and presented as part of the thread dump provided by the com.sun.management.HotSpotDiagnosticMXBean.dumpThreads API and the `jcmd Thread.dump_to_file` command. security-libs/javax.crypto: JDK-8347938: Add Support for the Latest ML-KEM and ML-DSA Private Key Encodings =============================================================================== This release of OpenJDK adds support for encoding ML-KEM and ML-DSA keys to PKCS#8 format using the DER-encoded ASN.1 CHOICE formats defined in Section 6, "Private Key Format" of RFC 9935 [0] and RFC 9881 [1]. This format is referred to as "seed". This release also introduces two new security and system properties to control which PKCS#8 encoding is used. This encoding is used when generating new keys with a `KeyPairGenerator` and as the output when translating them with `KeyFactory.translateKey`. These properties are `jdk.mlkem.pkcs8.encoding` and `jdk.mldsa.pkcs8.encoding`. The possible case-insensitive values of these properties are: * `seed`; the new format introduced in this release and the default. This is 64 bytes for ML-KEM and 32 bytes for ML-DSA. * `expandedKey`; the format used on introduction of ML-KEM and ML-DSA keys in OpenJDK 24. * `both`; a sequence containing both encodings. As older OpenJDK releases do not support the encoding introduced by this release, they will not be able to decode keys generated using the new default. To produce a key compatible with older releases, the encoding should be set to `encodedKey` and then the key either generated or an existing key passed to `translateKey`. As with all security and system property pairs, specifying a non-empty value for the system property takes precedence over the security property. [0] https://www.rfc-editor.org/rfc/rfc9935.html#name-private-key-format [1] https://www.rfc-editor.org/rfc/rfc9881.html#name-private-key-format hotspot/jfr: JDK-8382740: JFR: Disable jdk.OldObjectSample event for generational ZGC ======================================================================== Leak profiling using the JFR event `jdk.OldObjectSample` is now disabled for generational ZGC due to performance issues. Generational ZGC only does weak reference processing in the old generation, so sampling will cause garbage to be artificially kept alive until an old generation collection. security-libs/java.security: JDK-8372351: Add 2 WISeKey roots ================================ The following root certificates have been added to the cacerts truststore: Alias Name: wisekeyglobalrootgbca Distinguished Name: CN=OISTE WISeKey Global Root GB CA, OU=OISTE Foundation Endorsed, O=WISeKey, C=CH Serial Number: 76b1205274f0858746b3f8231af6c2c0 Valid From: Mon Dec 01 15:00:32 GMT 2014 Valid Until: Thu Dec 01 15:10:31 GMT 2039 Alias Name: wisekeyglobalrootgcca Distinguished Name: CN=OISTE WISeKey Global Root GC CA, OU=OISTE Foundation Endorsed, O=WISeKey, C=CH Serial Number: 212a560caeda0cab4045bf2ba22d3aea Valid From: Tue May 09 09:48:34 GMT 2017 Valid Until: Fri May 09 09:58:33 GMT 2042 JDK-8381796: Enhance Certificate parsing ======================================== With this release of OpenJDK, a security and system property `com.sun.security.crl.maxSize` is introduced which acts as a maximum size limit on a Certificate Revocation List (CRL) downloaded over the network. For URICertStore requests, the value is the maximum size in bytes of the DER-encoded CRL. For LDAPCertStore queries, the threshold is the sum of all CRLs downloaded from a single search. By default, the maximum size is 20MiB (20971520 bytes) and CRLs larger than this will be discarded. A value less than zero may be used to turn off the size limit and non-numeric values will be ignored. A non-empty value for the system property takes precedence over the security property. Enabling 'certpath' debug logging will output the current size limit and note any discarded CRLs. New in release OpenJDK 25.0.3 (2026-04-21): =========================================== Live versions of these release notes can be found at: * https://bit.ly/openjdk2503 * CVEs - CVE-2026-22007 - CVE-2026-22008 - CVE-2026-22013 - CVE-2026-22016 - CVE-2026-22018 - CVE-2026-22021 - CVE-2026-23865 - CVE-2026-34268 - CVE-2026-34282 * Changes - JDK-7191877: TEST_BUG: java/rmi/transport/checkLeaseInfoLeak/CheckLeaseLeak.java failing intermittently - JDK-8030957: AIX: Implement OperatingSystemMXBean.getSystemCpuLoad() and .getProcessCpuLoad() on AIX - JDK-8068378: [TEST_BUG]The java/awt/Modal/PrintDialogsTest/PrintDialogsTest.java instruction need to update - JDK-8183336: Better cleanup for jdk/test/java/lang/module/customfs/ModulesInCustomFileSystem.java - JDK-8212084: G1: Implement UseGCOverheadLimit - JDK-8244336: Restrict algorithms at JCE layer - JDK-8246037: Shenandoah: update man pages to mention -XX:+UseShenandoahGC - JDK-8255463: java/nio/channels/spi/SelectorProvider/inheritedChannel/InheritedChannelTest.java failed with ThreadTimeoutException - JDK-8256289: java/awt/Focus/AppletInitialFocusTest/AppletInitialFocusTest1.java failed with "RuntimeException: Wrong focus owner: java.awt.Button[button1,41,36,56x23,label=Button1]" - JDK-8274082: Wrong test name in jtreg run tag for java/awt/print/PrinterJob/SwingUIText.java - JDK-8286258: [Accessibility,macOS,VoiceOver] VoiceOver reads the spinner value wrong and sometime partially - JDK-8286865: vmTestbase/vm/mlvm/meth/stress/jni/nativeAndMH/Test.java fails with Out of space in CodeCache - JDK-8287062: com/sun/jndi/ldap/LdapPoolTimeoutTest.java failed due to different timeout message - JDK-8293484: AArch64: TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails on CPU with SHA512 feature support - JDK-8299304: Test "java/awt/print/PrinterJob/PageDialogTest.java" fails on macOS 13 x64 because the Page Dialog blocks the Toolkit - JDK-8307495: Specialize atomic bitset functions for aix-ppc - JDK-8313770: jdk/internal/platform/docker/TestSystemMetrics.java fails on Ubuntu - JDK-8316274: javax/swing/ButtonGroup/TestButtonGroupFocusTraversal.java fails in Ubuntu 23.10 with Motif LAF - JDK-8317838: java/nio/channels/Channels/SocketChannelStreams.java running into timeout (aix) - JDK-8318662: Refactor some jdk/java/net/httpclient/http2 tests to JUnit - JDK-8320677: Printer tests use invalid '@run main/manual=yesno - JDK-8333857: Test sun/security/ssl/SSLSessionImpl/ResumeChecksServer.java failed: Existing session was used - JDK-8333871: Check return values of sysinfo - JDK-8334928: Test sun/security/ssl/SSLSocketImpl/ReuseAddr.java failed: java.net.BindException: Address already in use - JDK-8335646: Nimbus : JLabel not painted with LAF defined foreground color on Ubuntu 24.04 - JDK-8336695: Update Commons BCEL to Version 6.10.0 - JDK-8339791: Refactor MiscUndecorated/ActiveAWTWindowTest.java - JDK-8341039: compiler/cha/TypeProfileFinalMethod.java fails with assertEquals expected: 0 but was: 2 - JDK-8342175: MemoryEaterMT fails intermittently with ExceptionInInitializerError - JDK-8342401: [TESTBUG] javax/swing/JSpinner/8223788/JSpinnerButtonFocusTest.java test fails in ubuntu 22.04 on SBR Hosts - JDK-8342640: GenShen: Silently ignoring ShenandoahGCHeuristics considered poor user-experience - JDK-8342659: Test vmTestbase/nsk/jdi/ObjectReference/referringObjects/referringObjects002/referringObjects002.java failed: Class nsk.share.jdi.TestClass1 was not unloaded - JDK-8343316: Review and update tests using explicit provider names - JDK-8343340: Swapping checking do not work for MetricsMemoryTester failcount - JDK-8343474: [updates] Customize README.md to specifics of update project - JDK-8344073: Test runtime/cds/appcds/TestParallelGCWithCDS.java#id0 failed - JDK-8346154: [XWayland] Some tests fail intermittently in the CI, but not locally - JDK-8346962: Test CRLReadTimeout.java fails with -Xcomp on a fastdebug build - JDK-8348014: Enhance certificate processing - JDK-8349192: jvmti/scenarios/contention/TC05/tc05t001 fails: ERROR: tc05t001.cpp, 281: (waitedThreadCpuTime - waitThreadCpuTime) < (EXPECTED_ACCURACY * 1000000) - JDK-8352149: Test java/awt/Frame/MultiScreenTest.java fails: Window list is empty - JDK-8353755: Add a helper method to Util - findComponent() - JDK-8354244: Use random data in MinMaxRed_Long data arrays - JDK-8354469: Keytool exposes the password in plain text when command is piped using | grep - JDK-8354894: java/lang/Thread/virtual/Starvation.java timeout on server with high CPUs - JDK-8354937: Cleanup some sparc related coding in os_linux - JDK-8356548: Use ClassFile API instead of ASM to transform classes in tests - JDK-8356868: Not all cgroup parameters are made available - JDK-8357277: Update OpenSSL library for interop tests - JDK-8357380: java/lang/StringBuilder/RacingSBThreads.java times out with C1 - JDK-8357390: java/awt/Toolkit/ScreenInsetsTest/ScreenInsetsTest.java Test failing on Ubuntu 24.04 Vm Hosts used by Oracle's internal CI system - JDK-8357470: src/java.base/share/classes/sun/security/util/Debug.java implement the test for args.toLowerCase - JDK-8357570: [macOS] os::Bsd::available_memory() might return too low values - JDK-8357591: Re-enable CDS test cases for jvmci after JDK-8345826 - JDK-8358058: sun/java2d/OpenGL/DrawImageBg.java Test fails intermittently - JDK-8358159: Empty mode/padding in cipher transformations - JDK-8358529: GenShen: Heuristics do not respond to changes in SoftMaxHeapSize - JDK-8358679: [asan] vmTestbase/nsk/jvmti tests show memory issues - JDK-8358686: CDS and AOT can cause buffer truncation warning even when logging is disabled - JDK-8358735: GenShen: block_start() may be incorrect after class unloading - JDK-8358756: [s390x] Test StartupOutput.java crash due to CodeCache size - JDK-8358801: javac produces class that does not pass verifier. - JDK-8359064: Expose reason for marking nmethod non-entrant to JVMCI client - JDK-8359182: Use @requires instead of SkippedException for MaxPath.java - JDK-8359388: Stricter checking for cipher transformations - JDK-8359418: Test "javax/swing/text/GlyphView/bug4188841.java" failed because the phrase of text pane does not match the instructions - JDK-8359472: JVM crashes when attaching a dynamic agent before JVMTI_PHASE_LIVE - JDK-8359707: Add classfile modification code to RedefineClassHelper - JDK-8359868: Shenandoah: Free threshold heuristic does not use SoftMaxHeapSize - JDK-8359978: Test javax/net/ssl/SSLSocket/Tls13PacketSize.java failed again with java.net.SocketException: An established connection was aborted by the software in your host machine - JDK-8360049: CodeInvalidationReasonTest.java fails with ZGC on AArch64 - JDK-8360160: ubuntu-22-04 machine is failing client tests - JDK-8360169: Problem list CodeInvalidationReasonTest.java on linux-riscv64 until JDK-8360168 is fixed - JDK-8360271: String.indexOf intrinsics fail with +EnableX86ECoreOpts and -CompactStrings - JDK-8360395: sun/security/tools/keytool/i18n.java user country is current user location instead of the language - JDK-8360539: DTLS handshakes fails due to improper cookie validation logic - JDK-8360562: sun/security/tools/keytool/i18n.java add an ability to add comment for failures - JDK-8360702: runtime/Thread/AsyncExceptionTest.java timed out - JDK-8360882: Tests throw SkippedException when they should fail - JDK-8361067: Test ExtraButtonDrag.java requires frame.dispose in finally block - JDK-8361106: [TEST] com/sun/net/httpserver/Test9.java fails with java.nio.file.FileSystemException - JDK-8361363: ShenandoahAsserts::print_obj() does not work for forwarded objects and UseCompactObjectHeaders - JDK-8361381: GlyphLayout behavior differs on JDK 11+ compared to JDK 8 - JDK-8361492: [IR Framework] Has too restrictive regex for load and store - JDK-8361521: BogusFocusableWindowState.java fails with StackOverflowError on Linux - JDK-8361530: Test javax/swing/GraphicsConfigNotifier/StalePreferredSize.java timed out - JDK-8361613: System.console() should only be available for interactive terminal - JDK-8361894: sun/security/krb5/config/native/TestDynamicStore.java ensure that the test is run with sudo - JDK-8362284: RISC-V: cleanup NativeMovRegMem - JDK-8362979: C2 fails with unexpected node in SuperWord truncation: CmpLTMask, RoundF - JDK-8363950: Incorrect jtreg header in TestLayoutVsICU.java - JDK-8364373: Transform Affine transformations - JDK-8364465: Enhance behavior of some intrinsics - JDK-8364580: Test compiler/vectorization/TestSubwordTruncation.java fails on platforms without RoundF/RoundD - JDK-8364741: [asan] runtime/ErrorHandling/PrintVMInfoAtExitTest.java fails because output differs slightly - JDK-8364756: JFR: Improve slow tests - JDK-8364936: Shenandoah: Switch nmethod entry barriers to conc_instruction_and_data_patch - JDK-8365065: cancelled ForkJoinPool tasks no longer throw CancellationException - JDK-8365184: sun/tools/jhsdb/HeapDumpTestWithActiveProcess.java Re-enable SerialGC flag on debuggee process - JDK-8365305: The ARIA role ‘contentinfo’ is not valid for the element