{"id":232992,"date":"2026-05-04T15:09:07","date_gmt":"2026-05-04T22:09:07","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/java\/?p=232992"},"modified":"2026-05-04T15:17:48","modified_gmt":"2026-05-04T22:17:48","slug":"java-openjdk-april-2026-patch-security-update","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/java\/java-openjdk-april-2026-patch-security-update\/","title":{"rendered":"Java OpenJDK April 2026 Patch &#038; Security Update"},"content":{"rendered":"<p class=\"code-line\" dir=\"auto\" data-line=\"2\">Hello Java customers!<\/p>\n<p class=\"code-line\" dir=\"auto\" data-line=\"4\">We are happy to announce the latest April 2026 patch &amp; security update release for the\u00a0<a href=\"https:\/\/aka.ms\/openjdk\" data-href=\"https:\/\/aka.ms\/openjdk\">Microsoft Build of OpenJDK<\/a>. Check our\u00a0<a href=\"https:\/\/learn.microsoft.com\/java\/openjdk\/release-notes\" data-href=\"https:\/\/learn.microsoft.com\/java\/openjdk\/release-notes\">release notes<\/a>\u00a0page for details on fixes and enhancements or\u00a0<a href=\"https:\/\/aka.ms\/msopenjdk-dl\" data-href=\"https:\/\/aka.ms\/msopenjdk-dl\">download and install<\/a>\u00a0the binaries today. The source code of our builds are now available on GitHub for further inspection:<\/p>\n<ul class=\"code-line\" dir=\"auto\" data-line=\"6\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"6\"><a href=\"https:\/\/github.com\/microsoft\/openjdk-jdk25u\/tree\/release\/jdk-25.0.3_9\" data-href=\"https:\/\/github.com\/microsoft\/openjdk-jdk25u\/tree\/release\/jdk-25.0.3_9\">OpenJDK 25.0.3<\/a>\u00a0(Note: this LTS has a separate source code branch for Microsoft&#8217;s release of\u00a0<a href=\"https:\/\/github.com\/microsoft\/openjdk-jdk25u\/tree\/release\/jdk-25.0.3_9-windows_aarch64\" data-href=\"https:\/\/github.com\/microsoft\/openjdk-jdk25u\/tree\/release\/jdk-25.0.3_9-windows_aarch64\">Windows AArch64 OpenJDK 25.0.3<\/a>)<\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"7\"><a href=\"https:\/\/github.com\/microsoft\/openjdk-jdk21u\/tree\/release\/jdk-21.0.11_10\" data-href=\"https:\/\/github.com\/microsoft\/openjdk-jdk21u\/tree\/release\/jdk-21.0.11_10\">OpenJDK 21.0.11<\/a><\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"8\"><a href=\"https:\/\/github.com\/microsoft\/openjdk-jdk17u\/tree\/release\/jdk-17.0.19_10\" data-href=\"https:\/\/github.com\/microsoft\/openjdk-jdk17u\/tree\/release\/jdk-17.0.19_10\">OpenJDK 17.0.19<\/a><\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"9\"><a href=\"https:\/\/github.com\/microsoft\/openjdk-jdk11u\/tree\/release\/jdk-11.0.31_11\" data-href=\"https:\/\/github.com\/microsoft\/openjdk-jdk11u\/tree\/release\/jdk-11.0.31_11\">OpenJDK 11.0.31<\/a><\/li>\n<\/ul>\n<h2 id=\"microsoft-build-of-openjdk-specific-updates\" class=\"code-line\" dir=\"auto\" data-line=\"11\">Microsoft Build of OpenJDK specific updates<\/h2>\n<h3 id=\"openjdk-25\" class=\"code-line\" dir=\"auto\" data-line=\"13\">OpenJDK 25<\/h3>\n<ul class=\"code-line\" dir=\"auto\" data-line=\"15\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"15\">Fixes for the following issues on Windows AArch64:\n<ul class=\"code-line\" dir=\"auto\" data-line=\"16\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"16\"><a href=\"https:\/\/bugs.openjdk.org\/browse\/JDK-8383541\" data-href=\"https:\/\/bugs.openjdk.org\/browse\/JDK-8383541\">8383541<\/a>: Safefetch should return the error value when accessing pages protected with PAGE_GUARD on Windows AArch64<\/li>\n<\/ul>\n<\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"17\">Implemented\u00a0<a href=\"https:\/\/bugs.openjdk.org\/browse\/JDK-8357445\" data-href=\"https:\/\/bugs.openjdk.org\/browse\/JDK-8357445\">JDK-8357445<\/a>: Time-Based Heap Uncommit During Idle Periods\n<ul class=\"code-line\" dir=\"auto\" data-line=\"18\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"18\">Added support for automatic uncommitting of unused G1 heap regions during idle periods to reduce memory footprint in containerized and cloud environments<\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"19\">Disable with -XX:+UnlockDiagnosticVMOptions -XX:-G1UseTimeBasedHeapSizing<\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"20\">Beneficial for:\n<ul class=\"code-line\" dir=\"auto\" data-line=\"21\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"21\">Containerized applications with variable workloads<\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"22\">Cloud deployments where memory usage affects billing<\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"23\">Applications needing memory footprint optimization with no effect on GC pause times<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"24\">AOTCache update\n<ul class=\"code-line\" dir=\"auto\" data-line=\"25\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"25\">jcmd AOT.end_training has been incorporated upstream<\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"26\">AOTCache MXBean is still included in the latest patch related to AOTCache<\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"27\">With the AOTCache MXBean, you can programmatically stop the recording of training data without stopping your application<\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"28\">It also allows an application to determine if the recording of training data is active and how long the recording ran for<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3 id=\"openjdk-21\" class=\"code-line\" dir=\"auto\" data-line=\"30\">OpenJDK 21<\/h3>\n<ul class=\"code-line\" dir=\"auto\" data-line=\"32\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"32\">Fixes for the following issues on Windows AArch64:\n<ul class=\"code-line\" dir=\"auto\" data-line=\"33\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"33\"><a href=\"https:\/\/bugs.openjdk.org\/browse\/JDK-8383541\" data-href=\"https:\/\/bugs.openjdk.org\/browse\/JDK-8383541\">8383541<\/a>: Safefetch should return the error value when accessing pages protected with PAGE_GUARD on Windows AArch64<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3 id=\"openjdk-17\" class=\"code-line\" dir=\"auto\" data-line=\"35\">OpenJDK 17<\/h3>\n<ul class=\"code-line\" dir=\"auto\" data-line=\"37\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"37\">Fixes for the following issues on Windows AArch64:\n<ul class=\"code-line\" dir=\"auto\" data-line=\"38\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"38\"><a href=\"https:\/\/bugs.openjdk.org\/browse\/JDK-8383541\" data-href=\"https:\/\/bugs.openjdk.org\/browse\/JDK-8383541\">8383541<\/a>: Safefetch should return the error value when accessing pages protected with PAGE_GUARD on Windows AArch64<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3 id=\"openjdk-11\" class=\"code-line\" dir=\"auto\" data-line=\"40\">OpenJDK 11<\/h3>\n<ul class=\"code-line\" dir=\"auto\" data-line=\"42\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"42\">No Microsoft-specific updates for this release.<\/li>\n<\/ul>\n<h2 id=\"summary-of-upstream-updates\" class=\"code-line\" dir=\"auto\" data-line=\"44\">Summary of Upstream Updates<\/h2>\n<p class=\"code-line\" dir=\"auto\" data-line=\"46\"><strong><a href=\"https:\/\/openjdk.org\/groups\/vulnerability\/advisories\/2026-04-21\" data-href=\"https:\/\/openjdk.org\/groups\/vulnerability\/advisories\/2026-04-21\">OpenJDK Vulnerability Advisory April 2026<\/a><\/strong><\/p>\n<h3 id=\"openjdk-25-1\" class=\"code-line\" dir=\"auto\" data-line=\"48\">OpenJDK 25<\/h3>\n<ul class=\"code-line\" dir=\"auto\" data-line=\"50\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"50\"><a href=\"https:\/\/bugs.openjdk.org\/browse\/JDK-8382656?jql=project%20%3D%20%2210100%22%20AND%20status%20in%20(Closed%2C%20Resolved)%20AND%20fixVersion%20%3D%2025.0.3\" data-href=\"https:\/\/bugs.openjdk.org\/browse\/JDK-8382656?jql=project%20%3D%20%2210100%22%20AND%20status%20in%20(Closed%2C%20Resolved)%20AND%20fixVersion%20%3D%2025.0.3\">List of fixes<\/a><\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"51\"><em>For further details, please refer to\u00a0<a href=\"https:\/\/www.oracle.com\/java\/technologies\/javase\/25all-relnotes.html\" data-href=\"https:\/\/www.oracle.com\/java\/technologies\/javase\/25all-relnotes.html\">Oracle&#8217;s page on JDK25 consolidated release notes<\/a><\/em>.<\/li>\n<\/ul>\n<h3 id=\"openjdk-21-1\" class=\"code-line\" dir=\"auto\" data-line=\"54\">OpenJDK 21<\/h3>\n<ul class=\"code-line\" dir=\"auto\" data-line=\"56\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"56\"><a href=\"https:\/\/bugs.openjdk.org\/browse\/JDK-8369643?jql=project%20%3D%20JDK%20AND%20status%20in%20(Closed%2C%20Resolved)%20AND%20fixVersion%20%3D%2021.0.11\" data-href=\"https:\/\/bugs.openjdk.org\/browse\/JDK-8369643?jql=project%20%3D%20JDK%20AND%20status%20in%20(Closed%2C%20Resolved)%20AND%20fixVersion%20%3D%2021.0.11\">List of fixes<\/a><\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"57\"><em>For further details, please refer to\u00a0<a href=\"https:\/\/www.oracle.com\/java\/technologies\/javase\/21all-relnotes.html\" data-href=\"https:\/\/www.oracle.com\/java\/technologies\/javase\/21all-relnotes.html\">Oracle&#8217;s page on JDK21 consolidated release notes<\/a><\/em>.<\/li>\n<\/ul>\n<h3 id=\"openjdk-17-1\" class=\"code-line\" dir=\"auto\" data-line=\"59\">OpenJDK 17<\/h3>\n<ul class=\"code-line\" dir=\"auto\" data-line=\"61\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"61\"><a href=\"https:\/\/bugs.openjdk.org\/browse\/JDK-8382677?jql=project%20%3D%20%2210100%22%20AND%20status%20in%20(Closed%2C%20Resolved)%20AND%20fixVersion%20%3D%2017.0.19\" data-href=\"https:\/\/bugs.openjdk.org\/browse\/JDK-8382677?jql=project%20%3D%20%2210100%22%20AND%20status%20in%20(Closed%2C%20Resolved)%20AND%20fixVersion%20%3D%2017.0.19\">List of fixes<\/a><\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"62\"><em>For further details, please refer to\u00a0<a href=\"https:\/\/www.oracle.com\/java\/technologies\/javase\/17all-relnotes.html\" data-href=\"https:\/\/www.oracle.com\/java\/technologies\/javase\/17all-relnotes.html\">Oracle&#8217;s page on JDK17 consolidated release notes<\/a><\/em>.<\/li>\n<\/ul>\n<h3 id=\"openjdk-11-1\" class=\"code-line\" dir=\"auto\" data-line=\"64\">OpenJDK 11<\/h3>\n<ul class=\"code-line\" dir=\"auto\" data-line=\"66\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"66\"><a href=\"https:\/\/bugs.openjdk.org\/browse\/JDK-8382813?jql=project%20%3D%20%2210100%22%20AND%20status%20in%20(Closed%2C%20Resolved)%20AND%20fixVersion%20%3D%2011.0.31\" data-href=\"https:\/\/bugs.openjdk.org\/browse\/JDK-8382813?jql=project%20%3D%20%2210100%22%20AND%20status%20in%20(Closed%2C%20Resolved)%20AND%20fixVersion%20%3D%2011.0.31\">List of fixes<\/a><\/li>\n<li class=\"code-line\" dir=\"auto\" data-line=\"67\"><em>For further details, please refer to\u00a0<a href=\"https:\/\/www.oracle.com\/java\/technologies\/javase\/11all-relnotes.html\" data-href=\"https:\/\/www.oracle.com\/java\/technologies\/javase\/11all-relnotes.html\">Oracle&#8217;s page on JDK11 consolidated release notes<\/a><\/em>.<\/li>\n<\/ul>\n<div class=\"code-line\" dir=\"auto\" data-line=\"69\"><\/div>\n<h3 id=\"openjdk-8\" class=\"code-line\" dir=\"auto\" data-line=\"74\">OpenJDK 8<\/h3>\n<p class=\"code-line\" dir=\"auto\" data-line=\"76\">We continue to provide support on Azure and internally at Microsoft for OpenJDK 8 binaries of Eclipse Temurin built by the Eclipse Adoptium project. To facilitate its usage, we ship\u00a0<a href=\"https:\/\/mcr.microsoft.com\/en-us\/product\/openjdk\/jdk\/tags\" data-href=\"https:\/\/mcr.microsoft.com\/en-us\/product\/openjdk\/jdk\/tags\">container images of OpenJDK 8<\/a>\u00a0on top of Azure Linux and Ubuntu. Refer to our\u00a0<a href=\"https:\/\/mcr.microsoft.com\/artifact\/mar\/openjdk\/jdk\/about\" data-href=\"https:\/\/mcr.microsoft.com\/artifact\/mar\/openjdk\/jdk\/about\">documentation<\/a>.<\/p>\n<ul class=\"code-line\" dir=\"auto\" data-line=\"78\">\n<li class=\"code-line\" dir=\"auto\" data-line=\"78\"><a href=\"https:\/\/adoptium.net\/temurin\/releases\/?version=8\" data-href=\"https:\/\/adoptium.net\/temurin\/releases\/?version=8\">Download the latest Temurin build of OpenJDK 8<\/a><\/li>\n<\/ul>\n<h4 id=\"questions\" class=\"code-line\" dir=\"auto\" data-line=\"80\">Questions?<\/h4>\n<p class=\"code-line\" dir=\"auto\" data-line=\"82\">Contact\u00a0<a href=\"mailto:openjdk-support@microsoft.com\" data-href=\"mailto:openjdk-support@microsoft.com\">openjdk-support@microsoft.com<\/a>.<\/p>\n<h4 id=\"amplify-the-news\" class=\"code-line\" dir=\"auto\" data-line=\"84\">Amplify the news!<\/h4>\n<p class=\"code-line\" dir=\"auto\" data-line=\"86\">LinkedIn:\u00a0<a href=\"https:\/\/www.linkedin.com\/posts\/joshmjaffe_hey-java-friends-were-happy-to-announce-share-7457176978215837696-ccer?utm_source=share&amp;utm_medium=member_desktop&amp;rcm=ACoAACSVMzcBPb-uFpJGqUtCMsuCqDsfIwseudY\" data-href=\"https:\/\/www.linkedin.com\/posts\/joshmjaffe_hey-java-friends-were-happy-to-announce-share-7457176978215837696-ccer?utm_source=share&amp;utm_medium=member_desktop&amp;rcm=ACoAACSVMzcBPb-uFpJGqUtCMsuCqDsfIwseudY\">LinkedIn post from Java at Microsoft<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hello Java customers! We are happy to announce the latest April 2026 patch &amp; security update release for the\u00a0Microsoft Build of OpenJDK. Check our\u00a0release notes\u00a0page for details on fixes and enhancements or\u00a0download and install\u00a0the binaries today. The source code of our builds are now available on GitHub for further inspection: OpenJDK 25.0.3\u00a0(Note: this LTS has [&hellip;]<\/p>\n","protected":false},"author":195057,"featured_media":227205,"comment_status":"open","ping_status":"closed","sticky":true,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1,8,249],"tags":[],"class_list":["post-232992","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-java","category-open-source","category-openjdk"],"acf":[],"blog_post_summary":"<p>Hello Java customers! We are happy to announce the latest April 2026 patch &amp; security update release for the\u00a0Microsoft Build of OpenJDK. Check our\u00a0release notes\u00a0page for details on fixes and enhancements or\u00a0download and install\u00a0the binaries today. The source code of our builds are now available on GitHub for further inspection: OpenJDK 25.0.3\u00a0(Note: this LTS has [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/java\/wp-json\/wp\/v2\/posts\/232992","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/java\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/java\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/java\/wp-json\/wp\/v2\/users\/195057"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/java\/wp-json\/wp\/v2\/comments?post=232992"}],"version-history":[{"count":2,"href":"https:\/\/devblogs.microsoft.com\/java\/wp-json\/wp\/v2\/posts\/232992\/revisions"}],"predecessor-version":[{"id":233014,"href":"https:\/\/devblogs.microsoft.com\/java\/wp-json\/wp\/v2\/posts\/232992\/revisions\/233014"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/java\/wp-json\/wp\/v2\/media\/227205"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/java\/wp-json\/wp\/v2\/media?parent=232992"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/java\/wp-json\/wp\/v2\/categories?post=232992"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/java\/wp-json\/wp\/v2\/tags?post=232992"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}